How can a Policy be created to Enforce Tagging where several options may exist?

Question

I'm trying to create an Azure Policy which enforces Tag creation.

Example;

When a User creates a Resource Group, they MUST add tags: Environment (PROD or DEV) Resource (VM or SQL).

Now there is a Built-in Policy in place called 'Enforce tag and its value on resource groups' however, the issue is that the tags and values seem to be hardcoded. I.e. When assigning a Policy, I am asked to enter the Name & Value attributes, e.g. Environment & Production.

This means that all resource groups created in the future, will need to have both 'Environment' & 'Production' added at creation time.

I do not understand the point of this. If I have pre-determined that all resource groups must contain the name & value of (environment & production) why not automate it, why even bother as the creator to add the tags in manually?

My question is: can I achieve this:

When a User creates a Resource Group, they MUST add tags: Environment (PROD or DEV) Resource (VM or SQL).

Answer 1

we have a built in definition call "Require tag and its value" which you can model for a custom policy. You will have to parameterize the Tag Value to be type array and list PROD and DEV in the array. You will need 2 definitions one for Environment and one for Resource tag.