ComplyJet reads a set of Azure resource tags during inventory sync and uses them to automatically populate inventory records — including ownership, description, and audit scope.
This means you can manage compliance metadata directly from Azure, without manually updating each resource in ComplyJet.
Supported Tag Keys
ComplyJet currently reads the following tag keys:
ResourceOwnerResourceDescriptionResourceOutOfScopeForAudits
Use the exact names shown above. Although Azure treats tag names as case-insensitive when storing them, ComplyJet reads tag values using exact key names — so the casing must match.
What Each Tag Does
ResourceOwner
Sets the inventory owner in ComplyJet.
Accepted values:
Full employee email — e.g.
[email protected]Email local-part only — e.g.
alex
ComplyJet first tries an exact email match, then falls back to matching the part before @. The person must already exist in ComplyJet for the match to succeed.
ResourceDescription
Sets the inventory description for the resource in ComplyJet.
Use plain language — for example:
Production customer-facing API
In the screenshots below, the tags ResourceOwner and ResourceDescription were applied to the cjqastorage Storage Account in Azure. After the next sync, the owner and description appeared automatically in ComplyJet's resource panel — no manual entry needed.
ResourceOutOfScopeForAudits
Controls whether the resource is considered in scope for compliance audits.
Accepted values:
true→ resource is marked out of scopefalse→ resource is marked in scope
Use lowercase true / false to avoid ambiguity.
Default Behavior
If no Azure tags are present on a resource:
New inventory resources default to the Engineering category owner
New inventory resources default to in scope = true
If Azure tags are present:
Tag values override those defaults during sync
Existing inventory records are updated when the matching tag is present
Important: Removing a tag in Azure does not clear the existing value in ComplyJet. To change a value via Azure sync, update the tag to a new value and run sync again.
Supported Azure Resource Types
Tags are read for the following Azure resource types:
Virtual Machines
Virtual Machine Scale Sets
AKS clusters
Azure Functions
Container Apps
Container Registry
Cosmos DB accounts
Azure SQL databases
Azure Database for MySQL
Azure Database for PostgreSQL
Storage Accounts
How to Add Tags in Azure
Using the Azure Portal
Open the Azure Portal and navigate to the resource you want to tag.
In the left sidebar, click Tags. Alternatively, click the edit link next to Tags in the Essentials section.
Add the tag names exactly as shown —
ResourceOwner,ResourceDescription,ResourceOutOfScopeForAudits— and enter the corresponding values.Click Apply to save.
Using the Azure CLI
The exact command varies by resource type. Here's the general form:
az resource tag \
--resource-group <resource-group> \
--name <resource-name> \
--resource-type <resource-type> \
--tags "[email protected]" \
"ResourceDescription=Production billing database" \
"ResourceOutOfScopeForAudits=false"
Recommended Tagging Standard
Apply all three tags to each supported Azure resource:
[email protected]
ResourceDescription=Production billing database
ResourceOutOfScopeForAudits=false
When Changes Appear in ComplyJet
Tag values are picked up during the next Azure inventory sync. After sync completes:
New resources will be created with the tagged values applied
Existing resources will be updated for any supported tag that is present
Troubleshooting
If tags are not showing up in ComplyJet after sync:
Confirm the tag key names use the exact casing shown above — ComplyJet reads them with exact key names
Confirm the tagged resource type is in the supported list above
ResourceOwnermust match a person already present in ComplyJetConfirm an Azure inventory sync has run after the tags were added