Excluding Azure resources with tags

Use the TidalExclude tag to exclude an Azure resource from the verdicts of supported checks. The resource's observed results, evidence and exclusion reason remain visible.

For help deciding whether to use a tag or a per-test exception, see Resource exclusions.

Exclude a resource with a tag

Add the tag to the resource in Azure, where you manage its scope.

Open the resource in the Azure portal and select Tags.
Add a tag named TidalExclude and use its value to explain the exclusion, for example Development sandbox outside audit scope.
Save the tag, then run the relevant Tidal Control tests again or wait for the next scheduled run.

The tag name is case-sensitive. Any value excludes the resource, including an empty value or false. Remove the tag to stop the exclusion.

Supported resources and scope

Tag exclusions apply to supported resources collected by the Azure integration:

Virtual machines, managed disks and Kubernetes clusters.
Storage accounts, virtual networks and network security resources.
Function apps, key vaults and managed identities.
SQL servers, SQL databases, PostgreSQL flexible servers and AI Services accounts.

Related settings can inherit the resource's exclusion. For example, SQL databases inherit their server's exclusion, including its reason. Patch and Defender assessments follow the tag on the resource they assess.

Tags on resource groups or subscriptions do not exclude their contents. Entra users, Intune devices, role assignments and subscription policy checks are outside this feature.

Review or remove an exclusion

Excluded resources remain in test evidence with their observed Passed or Failed result and the tag value as the reason. Adding or removing a tag affects subsequent runs; saved results keep their original evidence.

Remove TidalExclude in Azure and run the relevant tests again to include the resource in future results. Any per-test exclusions still apply.

To include the resource in a saved result, use Include in that result's evidence table. This does not remove the Azure tag, so future runs still follow it. Tag exclusions do not prevent technical Errors, and some tests still require at least one included resource to pass.