# Resource 'myresource' was disallowed by policy. Policy: 'Require a tag on resources'. Reason: 'The resource has no tags.'

- **ID:** `policy/azure-policy-tagging-enforcement-failure`
- **Domain:** policy
- **Category:** config_error
- **Error Code:** `Conflict`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Azure Policy initiative requires specific tags on all resources; missing tags cause deployment denial.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Azure CLI 2.57.0 | active | — | — |
| Azure Policy 1.0.0 | active | — | — |

## Workarounds

1. **Add required tags in the deployment template. For ARM templates, add 'tags': { 'Environment': 'Production' } in the resource definition.** (90% success)
   ```
   Add required tags in the deployment template. For ARM templates, add 'tags': { 'Environment': 'Production' } in the resource definition.
   ```
2. **Use Azure CLI to deploy with tags: 'az deployment group create --resource-group myRG --template-file template.json --parameters tags={Environment:Production}'** (85% success)
   ```
   Use Azure CLI to deploy with tags: 'az deployment group create --resource-group myRG --template-file template.json --parameters tags={Environment:Production}'
   ```
3. **Request policy exemption for the resource group from Azure Policy team via: 'az policy exemption create --name myExemption --policy-assignment <assignment-id> --scope /subscriptions/<sub-id>/resourceGroups/<rg>'** (70% success)
   ```
   Request policy exemption for the resource group from Azure Policy team via: 'az policy exemption create --name myExemption --policy-assignment <assignment-id> --scope /subscriptions/<sub-id>/resourceGroups/<rg>'
   ```

## Dead Ends

- **Redeploy the resource without any changes, hoping the policy is temporary.** — Azure Policy is persistent and evaluated on every deployment; the same error will occur. (100% fail)
- **Remove the resource group and recreate it.** — The policy is applied at subscription or management group level, not resource group. Deleting the group doesn't remove the policy requirement. (99% fail)
- **Add tags after deployment via Azure Portal.** — The policy blocks the deployment itself; the resource is never created to add tags later. (90% fail)