Get-AzureTagComplianceReport

<#
.SYNOPSIS
    Checks resource groups against a required tag list.

.DESCRIPTION
    Compares tags on every resource group against a configurable list of
    required tags and reports which ones are missing, so cost center and
    ownership reporting built on those tags stays reliable instead of
    silently incomplete.

.PARAMETER RequiredTags
    Array of tag names that must be present. Defaults to Environment, Owner, CostCenter.

.EXAMPLE
    .\Get-AzureTagComplianceReport.ps1 -RequiredTags @("Environment","Owner")

.NOTES
    Requires the Az.Resources module and an active Connect-AzAccount session.

.AUTHOR
    Shehryar Hassan
#>

param(
    [string[]]$RequiredTags = @("Environment", "Owner", "CostCenter")
)

$groups = Get-AzResourceGroup

$report = foreach ($group in $groups) {
    $existingTags = if ($group.Tags) { $group.Tags.Keys } else { @() }
    $missing = $RequiredTags | Where-Object { $_ -notin $existingTags }
    [pscustomobject]@{
        ResourceGroup = $group.ResourceGroupName
        MissingTags   = $missing -join ", "
        Compliant     = $missing.Count -eq 0
    }
}

$report | Where-Object { -not $_.Compliant } | Format-Table -AutoSize
Write-Warning "$(($report | Where-Object { -not $_.Compliant }).Count) of $($groups.Count) resource group(s) missing required tags."