# Resource 'myresource' was disallowed by policy. Policy: 'Inherit a tag from the resource group if missing'. Reason: 'The resource has no tags.'

- **ID:** `policy/azure-policy-tag-inheritance-failure`
- **Domain:** policy
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Azure Policy 'Inherit a tag from the resource group if missing' requires resources to have at least the inherited tag, but the policy engine fails to apply inheritance if the resource group itself lacks the tag or if the resource is created before the policy assignment.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Azure Policy v1.0 | active | — | — |
| Azure Resource Manager 2023-03-01 | active | — | — |
| Terraform AzureRM Provider v3.90.0 | active | — | — |

## Workarounds

1. **Ensure the resource group has the required tag before creating the resource: az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production. Then retry resource creation.** (85% success)
   ```
   Ensure the resource group has the required tag before creating the resource: az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production. Then retry resource creation.
   ```
2. **Create a policy exemption for the specific resource or resource group via Azure Portal: Policy > Compliance > select policy > Create exemption.** (75% success)
   ```
   Create a policy exemption for the specific resource or resource group via Azure Portal: Policy > Compliance > select policy > Create exemption.
   ```
3. **Use a deployment script to retroactively apply tags to existing resources: az resource tag --tags Environment=Production --ids <resource-id>.** (80% success)
   ```
   Use a deployment script to retroactively apply tags to existing resources: az resource tag --tags Environment=Production --ids <resource-id>.
   ```

## Dead Ends

- **** — Adding a tag to the resource manually via portal does not resolve the policy violation because the policy expects automatic inheritance from the resource group. (70% fail)
- **** — Deleting and recreating the resource without ensuring the resource group has the tag still results in the same error. (80% fail)
- **** — Disabling the policy globally is not allowed for non-admin users and may violate organizational compliance. (90% fail)