Is there any way to prevent everyone to delete or modify a specific tag added to resources but just add it?

[sonalikaroy]

Is there any way to prevent every to delete or modify a specific tag added to resources?

[sonalikaroy]

Is there any way to prevent everyone to delete or modify a specific tag added to resources but just add it?

[camillemarie]

Can you provide a more specific example of what you'd like to accomplish?

You can do this with two policies: use a deny policy to prevent changing the tag value, and an append policy to always add the tag.

[mentat9]

Closing this issue per changes to the support model for this repo. See the Getting Support section in the readme for details and Azure Policy support information.

[m-soltani]

still like to follow up on this. I have a createDate Tag which I want to prevent users from deleting or modifying this tag. How is it possible with Policies? There are no deny action effects available.

Using a deny policy as @camillemarie stated above, prevents user from creating the resource, not from modifying that tag afterwards.

[elderrollins]

Did we find an answer to this? I am trying the same thing, and can't find a solution.

[m-soltani]

There is no way to do this, as of now - and the fact that the issue has been closed shows that the team probably do not consider to add this in their planned tasks for development.

[nehakulkarni123]

Hi @m-soltani, I may need to understand your use case further, but wanted to share the modify effect that released after you first created this issue:

• Modify effect: enables you to add, update, or remove properties or tags on a subscription or resource during creation or update. We have several samples available in Azure Policy's built in definition library

[m-soltani]

@nehakulkarni123: The modified effect as described allow you to add, update, remove specific tags. We want to forbid updating the tag values, categorically. Let's say the resource has a creationDate tag with some datatime assigned as the value of the tag. I want to have a policy enforcement in place in which it disallows users to go ahead and edit the value, basically change the datetime value.

That is not possible, right?