The $100K Problem That Resource Tags Would Have Prevented [2025 Guide]

Total machines: 1,791
Machines needing updates: 1,791

348 Windows/Linux servers (should be in Update Manager)
900 Citrix VDI hosts (managed through Intune + golden images)
170 Databricks cluster nodes (managed by Databricks service)
46 security appliances (Palo Alto, F5 - vendor tools only)
44 Windows 10/11 dev workstations (need Intune, not Update Manager)
20 network appliances (switches, routers - vendor managed)
7 storage appliances (vendor managed)
Various other specialized systems

Total: 1,791 machines
Actually need Update Manager: 348 (19%)

Satellite infrastructure: $12K/year
RHEL 6 Extended Life Cycle Support: $47K/year  
Total: $59K/year × 2 years = $118,000

Arc licensing (2025 pricing): $5/server/month × 35 servers × 12 months = $2,100/year
2-year Arc cost: $2,100 × 2 = $4,200
Savings we didn't get: $113,800

Tag: Type
Values: Server | Desktop | Appliance | Database-Cluster | VDI-Host | Container-Host
Purpose: Fundamental classification - determines which management tools apply
Example: Type: Server

Type: Server
→ Can use Azure Update Manager
→ Should appear in patching reports
→ Normal server OS patching rules apply

Type: Desktop  
→ Cannot use Update Manager (shows "unsupported")
→ Needs Intune or SCCM
→ Different patching schedule than servers

Type: Appliance
→ Cannot use Update Manager (shows "no updates data")
→ Vendor-specific management tools required
→ Should be filtered OUT of Update Manager entirely

Type: Database-Cluster
→ Managed by the service (Databricks, etc.)
→ Should be filtered OUT of Update Manager
→ Different cost allocation model

Type: VDI-Host
→ Patched via golden image updates
→ Different process than individual servers
→ Managed by desktop team, not server team

Tag: Owner
Values: Finance-Team, Marketing-Team, Engineering-Team, IT-Infrastructure, Security-Team
Purpose: Who owns this resource and makes decisions about it
Example: Owner: Finance-Team

Why critical: Delegation and accountability

Tag: Application  
Values: ERP-System, CRM, Databricks, Citrix-VDI, Palo-Alto-Firewall, SQL-Server, etc.
Purpose: What workload/application this resource supports
Example: Application: ERP-System

Why critical: 
- Application-level reporting and dependency mapping
- Migration planning (which apps can move to Azure)
- License tracking (SQL Server, Oracle, etc.)
- Disaster recovery grouping

// Find applications that must stay on-premises
Resources
| where type =~ "microsoft.hybridcompute/machines"
| extend app = tostring(tags.Application)
| where app in ("Palo-Alto-Firewall", "F5-Load-Balancer", "Legacy-Mainframe")
| summarize VMCount = count() by app

// Find modern applications ready for Azure
Resources
| where type =~ "microsoft.hybridcompute/machines"
| extend 
    app = tostring(tags.Application),
    osName = tostring(properties.osName)
| where osName contains "Windows Server 2019" or osName contains "Windows Server 2022"
| where app !in ("Palo-Alto-Firewall", "F5-Load-Balancer")
| summarize VMCount = count() by app
| order by VMCount desc

// Which migration waves have highest cost impact
Resources
| where type =~ "microsoft.hybridcompute/machines"
| where tags.Type == "Server"
| extend 
    app = tostring(tags.Application),
    wave = tostring(tags.MigrationWave)
| join kind=leftouter (
    ConsumptionUsageDetails
    | where ChargeType == "Usage"
    | summarize MonthlyCost = sum(CostInBillingCurrency) by ResourceId
) on $left.id == $right.ResourceId
| summarize 
    VMCount = count(),
    TotalMonthlyCost = sum(MonthlyCost)
by app, wave
| order by wave asc, TotalMonthlyCost desc

Tag: Environment
Values: Production | Development | Test | Staging | DR
Purpose: Deployment environment for change control and scheduling
Example: Environment: Production

Why critical: 
- Production patches first (or last, depending on risk tolerance)
- Dev/Test can have more aggressive patching schedules
- Cost allocation (prod vs non-prod)

Tag: CostCenter
Values: 680-5019, 680-5056, 680-5101 (your accounting codes)
Purpose: Which budget/department pays for this resource
Example: CostCenter: 680-5019

Why critical: 
- Chargeback to business units
- Budget planning
- Cost optimization by department

Tag: PatchingMethod
Values: Azure-Update-Manager | SCCM | Intune | Vendor-Managed | Golden-Image | Manual
Purpose: Which tool/process patches this resource
Example: PatchingMethod: Azure-Update-Manager

Why critical:
- Determines which tool to use
- Prevents conflicts (two tools trying to patch same system)
- Clear operational responsibility

Combined with Type:
- Type: Server + PatchingMethod: Azure-Update-Manager (correct)
- Type: Desktop + PatchingMethod: Intune (correct)
- Type: Appliance + PatchingMethod: Vendor-Managed (correct)

PatchingOwner: Cloud-Team | SCCM-Team | Linux-Admin | Security-Team
MaintenanceWindow: Sunday-2AM | Wednesday-Midnight | Saturday-3AM
Criticality: Critical | High | Medium | Low
Compliance: PCI-DSS | HIPAA | SOX | None  
BackupPolicy: Daily | Weekly | None
DataClassification: Public | Internal | Confidential | Restricted

Migration-specific tags:
MigrationWave: Wave-1 | Wave-2 | Wave-3 | Stay-OnPrem
AzureReady: Yes | No | Needs-Assessment | Vendor-Validation-Required
MigrationBlocker: None | Legacy-App | Licensing | Hardware-Dependency

Future-proofing (2025+ trends):
Workload: Traditional | AI | GenAI | ML-Training | ML-Inference
SustainabilityTracking: Yes | No
DataResidency: US | EU | APAC | Multi-Region

// Complete inventory of Arc-connected machines
Resources
| where type == "microsoft.hybridcompute/machines"
| extend 
    osType = tostring(properties.osType),
    osName = tostring(properties.osName),
    osVersion = tostring(properties.osVersion),
    cpuCount = toint(properties.detectedProperties.coreCount),
    memoryGB = toint(properties.detectedProperties.totalPhysicalMemoryInBytes) / 1024 / 1024 / 1024
| project 
    name,
    resourceGroup,
    osType,
    osName,
    osVersion,
    cpuCount,
    memoryGB,
    tags
| order by name asc

Resources
| where type == "microsoft.hybridcompute/machines"
| extend osName = tostring(properties.osName)
| extend potentialType = case(
    osName contains "Windows Server", "Server",
    osName contains "Red Hat Enterprise Linux", "Server",
    osName contains "Ubuntu", "Server",
    osName contains "CentOS", "Server",
    osName contains "Windows 10", "Desktop",
    osName contains "Windows 11", "Desktop",
    "Unknown - Investigate"
)
| summarize count() by potentialType, osName
| order by count_ desc

Resources
| where type == "microsoft.hybridcompute/machines"
| where isnull(tags.Type) or tags.Type == ""
| extend osName = tostring(properties.osName)
| project name, resourceGroup, osName
| order by name asc

// Group by naming patterns
Resources
| where type == "microsoft.hybridcompute/machines"
| extend 
    prefix = substring(name, 0, indexof(name, "-")),
    osName = tostring(properties.osName)
| summarize 
    count(),
    OSTypes = make_set(osName)
by prefix
| order by count_ desc

# Import your classification spreadsheet
$vmClassification = Import-Csv -Path "C:\VM-Classification-Complete.csv"

# Connect to Azure
Connect-AzAccount

$successCount = 0
$failCount = 0
$errors = @()

# Bulk apply tags to Arc-connected machines
foreach ($vm in $vmClassification) {
    try {
        $arcMachine = Get-AzConnectedMachine -Name $vm.VMName -ErrorAction Stop

        $tags = @{
            Type = $vm.Type
            Owner = $vm.Owner
            Application = $vm.Application
            Environment = $vm.Environment
            CostCenter = $vm.CostCenter
            PatchingMethod = $vm.PatchingMethod
        }

        Update-AzTag -ResourceId $arcMachine.Id -Tag $tags -Operation Merge -ErrorAction Stop

        Write-Host "✓ Tagged: $($vm.VMName)" -ForegroundColor Green
        $successCount++
    }
    catch {
        Write-Warning "✗ Failed: $($vm.VMName) - $($_.Exception.Message)"
        $errors += [PSCustomObject]@{
            VMName = $vm.VMName
            Error = $_.Exception.Message
        }
        $failCount++
    }
}

Write-Host "`nTagging Complete:" -ForegroundColor Cyan
Write-Host "  Success: $successCount VMs" -ForegroundColor Green
Write-Host "  Failed: $failCount VMs" -ForegroundColor Red

if ($errors.Count -gt 0) {
    $errors | Export-Csv -Path "C:\Tagging-Errors.csv" -NoTypeInformation
    Write-Host "`nErrors exported to: C:\Tagging-Errors.csv" -ForegroundColor Yellow
}

Resources
| where type == "microsoft.hybridcompute/machines"
| extend 
    hasType = isnotnull(tags.Type),
    hasOwner = isnotnull(tags.Owner),
    hasEnvironment = isnotnull(tags.Environment),
    hasCostCenter = isnotnull(tags.CostCenter)
| extend Compliance = iff(hasType and hasOwner and hasEnvironment and hasCostCenter, "Compliant", "Non-Compliant")
| summarize 
    TotalVMs = count(),
    CompliantVMs = countif(Compliance == "Compliant"),
    NonCompliantVMs = countif(Compliance == "Non-Compliant")
| extend ComplianceRate = round(100.0 * CompliantVMs / TotalVMs, 1)
| project TotalVMs, CompliantVMs, NonCompliantVMs, ComplianceRate

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.HybridCompute/machines"
        },
        {
          "anyOf": [
            {
              "field": "tags['Type']",
              "exists": "false"
            },
            {
              "field": "tags['Owner']",
              "exists": "false"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

New-AzPolicyDefinition `
  -Name "require-tags-on-arc-vms" `
  -DisplayName "Require Type and Owner tags on Arc machines" `
  -Policy (Get-Content -Path ".\require-arc-tags-policy.json" -Raw)

New-AzPolicyAssignment `
  -Name "enforce-arc-tagging" `
  -Scope "/subscriptions/{subscription-id}" `
  -PolicyDefinition (Get-AzPolicyDefinition -Name "require-tags-on-arc-vms")

Resources
| where type =~ "microsoft.compute/virtualmachines" 
    or type =~ "microsoft.hybridcompute/machines"
| where tags.Type == "Server"
| where tags.PatchingMethod == "Azure-Update-Manager"
| project 
    name, 
    resourceGroup,
    Type = tags.Type,
    Owner = tags.Owner,
    Environment = tags.Environment
| order by name asc

Resources
| where type =~ "microsoft.hybridcompute/machines"
| extend vmType = tostring(tags.Type)
| summarize count() by vmType
| order by count_ desc

Resources
| where type =~ "microsoft.compute/virtualmachines" 
    or type =~ "microsoft.hybridcompute/machines"
| extend costCenter = tostring(tags.CostCenter)
| join kind=leftouter (
    ConsumptionUsageDetails
    | where ChargeType == "Usage"
    | summarize MonthlyCost = sum(CostInBillingCurrency) by ResourceId
) on $left.id == $right.ResourceId
| summarize TotalCost = sum(MonthlyCost) by costCenter
| order by TotalCost desc

Resources  
| where type =~ "microsoft.hybridcompute/machines"
| extend patchMethod = tostring(tags.PatchingMethod)
| summarize VMCount = count() by patchMethod
| extend EstimatedMonthlyCost = case(
    patchMethod == "Azure-Update-Manager", VMCount * 5,
    patchMethod == "Satellite", VMCount * 100,
    patchMethod == "SCCM", 0,
    patchMethod == "Intune", VMCount * 10,
    0
)
| order by EstimatedMonthlyCost desc

35 actual RHEL 6 servers (Type: Server)
- Application: ERP-System (23 servers) - Finance
- Application: HR-Portal (8 servers) - HR  
- Application: Development-Tools (4 servers) - IT

8 RHEL 6-based appliances (Type: Appliance)
- Application: SolarWinds-Monitor (3 appliances)
- Application: Network-Management (5 appliances)

4 RHEL 6 workstations (Type: Desktop)
- Application: Developer-Workstation (4 workstations)