Tag based Service mapping - Shared resource tagging

[bipinksingh]

As per the best practices if we have an Azure Cloud resources that support multiple Application Services (Shared across multiple applications) how can we tag them in Azure as Azure support only one tag for a resource. How we can achieve a unified Service Maps using the Tag based mapping for the shared resources.

[shubhamseth]

@bipinksingh 

This is my approach: see if it helps.

Azure resource tags are key-value pairs, so while a single tag key can have only one value, a resource can have multiple different tags. However, using a single Application tag for a shared resource isn't a good approach because it can only represent one application.

For shared resources such as Application Gateway, Key Vault, SQL Database, App Service Plan, Storage Account, or Load Balancer, I'd avoid relying solely on Azure tags to build Service Maps.

A better approach is to use tags to identify ownership or environment (for example, Environment=Prod, BusinessUnit=Finance, Shared=True) and let Service Mapping discover the actual runtime dependencies. This allows the same Azure resource to be related to multiple Business Services in the CMDB without duplicating the CI.

If you're using Tag-based Service Mapping, consider introducing a dedicated tag such as Shared=True and use Discovery/Integration logic to associate that CI with multiple Business Services based on your mapping rules rather than a single application tag.

This approach keeps the Azure tagging strategy simple while maintaining accurate Service Maps for shared infrastructure.

[ayushraj7012933]

hi @bipinksingh 

 an Azure resource can only have one value for a specific tag key, it's difficult to associate a shared resource directly with multiple Application Services using tags alone. Because of this limitation, I wouldn't recommend trying to force multiple application names into a single tag.

A better approach is to treat the shared resource as its own shared service. For example, if you have a shared SQL Database, Key Vault, Storage Account, or Load Balancer that's used by several applications, create a separate Application Service (or technical/shared service) for that shared infrastructure. Then relate the consuming application services to it within ServiceNow. This gives you a much cleaner and more accurate service topology.

For Azure tagging, you can use tags to identify that the resource is shared (for example, Shared=True or ResourceType=Shared) rather than trying to map it to a single application. The ownership and relationships can then be maintained in ServiceNow instead of relying solely on Azure tags.

If your requirement is for the same Azure resource to appear in multiple service maps, Tag-Based Service Mapping by itself won't achieve that. In those scenarios, you'll typically need to complement it with Service Mapping relationships or manual/model-based associations so the shared infrastructure is correctly represented across all consuming services.

This approach aligns well with CSDM principles and is generally easier to maintain as your environment grows.