Hi, Azure admin here. The Azure Policy service includes a set of built-in policies to handle tags. There's one policy that requires new resource groups to be created with specific tags. Another policy allows resources within the resource group to inherit the same tags. I think this combination of policies would solve the tagging problem quite neatly, though I haven't tested it myself.