CreatedBy and CreatedOn tags on every Azure resource, automatically

Every cost review and every cleanup starts with the same question, who made this, and Azure cannot answer it once the Activity Log ages out. The feedback request has hundreds of votes and a decade of silence.

• Polls the subscription Activity Log every fifteen minutes for resource creation events.
• Stamps CreatedBy and CreatedOn tags on each newly created resource.
• Never overwrites a tag that already exists.
• Read access plus tag write only; it cannot modify anything but tags.

• Resources created before installation stay untagged unless you backfill them yourself; the Activity Log only reaches back ninety days.
• A resource created by a pipeline is tagged with the pipeline's identity, which is the truthful answer.
• The one write path, honestly scoped: Writing CreatedBy and CreatedOn tags on newly created resources. It writes no other tag and never overwrites an existing one.

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Alerts go to no channel; this app writes tags rather than sending alerts. Nothing is sent anywhere else.