Dynatrace version 1.348+
This documentation describes the new tagging model for Latest Dynatrace. Some capabilities are still rolling out. If you're currently using Dynatrace Classic auto-tagging, see Dynatrace Classic versus Latest Dynatrace to understand how your existing setup maps to the new model.
Primary Grail fields and tags are the basis for segments, pipeline routing, bucket assignment, Grail permissions, and cost allocation, applied consistently across logs, metrics, spans, events, and Smartscape entities.
This page covers enriching telemetry from Azure Cloud Platform monitoring, as well as Azure compute services monitored with OneAgent. For general OneAgent enrichment beyond Azure, see OneAgent.
Dynatrace automatically populates the following primary Grail fields on all telemetry from your Azure connection, with no additional configuration:
azure.subscription (permission-relevant)azure.resource.group (permission-relevant)azure.locationIf filtering, routing, and access control at the subscription, resource group, or location level cover your use case, there's nothing else to do. For all other cases, Dynatrace offers the following options to make your Azure tags available as primary Grail fields and tags.
Dynatrace version 1.348+
Central configuration for cloud tags is expected to be available in September 2026. Until it ships, use Azure connection settings to enrich your Azure services data.
If your Azure resources already carry tags that represent the context you want, such as team ownership, environment, cost center, or a security boundary, promote them with central configuration builtin:ingest.enrichment.config. No changes to your Azure resources are required. This option has two parts, A and B.
Create rules to select existing Azure tags (source) and map them to primary fields (target) like dt.security_context, dt.cost.costcenter, and dt.cost.product.
You can also make the existing Azure tags available on all telemetry by choosing Kubernetes or cloud tag as target. This forwards the Azure tag onto telemetry as the standard field azure.tags.<key>. Promote it to a primary_tags.* tag in part B.
To create a rule:
builtin:ingest.enrichment.config and select New rule.team.azure.tags.team -> dt.security_context when you select Security context as the target.Azure tag keys are forwarded to telemetry as azure.tags.<key>. Tag values are stored as originally set.
Note: In the central configuration you can also add a Custom rule which enables you to enrich a static string literal on all telemetry. The static literal can be used as Security context, Cost center, or Cost product, or directly as a Primary tag.
Forwarded Azure tags arrive in OpenPipeline as azure.tags.<key>, which is not yet a primary tag. To make it a primary_tags.* tag that you can use uniformly across Dynatrace, review your OpenPipeline primary Grail tag rules.
Define the target primary_tags.<key> once and list the source fields to read from, in order. The first source with a non-null value is used to set the target.
Azure tags land under different field names on telemetry data, for example, azure.tags.team, and on Smartscape nodes, for example, `tags:azure`[team]. This is why we recommend defining two source entries for the Azure tag:
azure.tags.team: covers telemetry like logs, metrics, spans, and events.`tags:azure`[team]: covers Azure Smartscape nodes. Dynatrace version 1.343+Listing both under the same primary_tags.team target covers all data types with one rule. You can also add the equivalent fields from other cloud providers to the same rule, so a single primary_tags.team definition works across AWS, Azure, Google Cloud, and Kubernetes.
For the full setup, see Set primary Grail tag rules in OpenPipeline.
OneAgent version 1.343+
If you monitor Azure services with OneAgent, you can create a rule in the central enrichment configuration with the Host/process property rule type and select the Azure tag that you want to use as source. OneAgent reads those tags from the Azure instance metadata and enriches them as Security context, Cost center, or Cost product, or directly as a Primary tag on all telemetry.
As a last resort, use the general OpenPipeline processing feature set to influence how ingested signals (metrics, logs, spans, events, and Smartscape nodes) are enriched. Among other things, you can add a primary_tags.* field to records with a processing step. Use this only when the other options don't cover your use case.
Central configuration rules can be defined at different deployment scopes in Dynatrace settings:
Environment-wide rules are appended after the subscription-specific ones. Rules are evaluated in order, and the first rule for a given target wins. For example, if three rules set dt.security_context, the first match is used.
The cloud scopes AWS account, Azure subscription, and GCP project will only be available for Cloud Platform monitoring connections. Other Dynatrace components, such as OneAgent, Dynatrace Operator, and ActiveGate, don't use those.
Host group scope is used with OneAgent (Host/process property rules and Custom rule type).
Kubernetes cluster scope is used by Dynatrace Operator and ActiveGate (Kubernetes and Custom rule types).
For now, you can configure tag enrichment either on the Azure connection or through central enrichment configuration. Connection-based tag enrichment will be phased out in the future.
Connections with connection-based tag enrichment have a Tag enrichment setting with a Use new unified enrichment settings toggle:
The first time you turn on the toggle, your existing connection-based tag enrichment is migrated to central configuration in the background. This one-time migration happens automatically, with no separate migration step.
Select Ingest enrichment configuration to open the central enrichment configuration.
For connection settings details, see Azure connection settings.
Primary Grail fields and tags appear as top-level fields and can be queried with DQL.
fetch logs| filter azure.subscription == "27e9b03f-04d2-2b69-b327-32f433f7ed21" AND primary_tags.team == "payments"
fetch bizevents| filter dt.cost.costcenter == "it_services"| summarize sum(value), by: {dt.cost.product}
fetch logs| filter dt.security_context == "confidential"| filter azure.location == "westeurope"
builtin:ingest.enrichment.config or OpenPipeline primary Grail tag rules builtin:openpipeline.primary-grail-tag can take up to 10 minutes to propagate.