Auto Tagger — CreatedBy and CreatedOn for Every Resource

WHAT IT DOES

Auto Tagger deploys into your subscription as a managed application. Every 15 minutes it reads the subscription Activity Log, finds newly created resources, and stamps two tags on each: CreatedBy (the user or service principal that created it) and CreatedOn (the creation timestamp). Tag names are configurable. It uses the generic Azure Tags API, so it works across resource types without per-service integration.

WHO IT IS FOR

Platform teams, FinOps practitioners, and subscription owners who need ownership attribution for cost allocation, cleanup, and governance — especially in shared subscriptions where many teams deploy.

WHY IT IS SAFE

No vendor backend. The tagger runs on a consumption Function inside your subscription with exactly two roles: Reader (to read the Activity Log) and Tag Contributor (to write tags). Nothing leaves your subscription. Delete the managed application and it is fully gone; the tags it wrote remain yours.

SETUP

Deploy from the marketplace, optionally customize the tag names, and run one script to grant the managed identity its two roles. New resources start getting tagged within 15 minutes.