title: Tags Management category: Tags & Classification tags: tags, classification, categories, filtering, organization priority: Normal

Tags Management

Tags in IdentityCenter provide a flexible classification system for organizing and labeling identities, objects, and groups. They enable targeted filtering, policy scoping, and operational workflows that go beyond the fixed attributes synced from your directories.

Accessing Tags Management

Navigate to Administration > Tags Management or go directly to /admin/tags-management. The Tags Management page displays all existing tags, their categories, and usage statistics.

Creating Tags

To create a new tag:

1. Click Create Tag on the Tags Management page
2. Fill in the tag properties:

3. Click Save to create the tag

Naming Conventions

Choose tag names that are concise, consistent, and self-explanatory:

Tag Categories

Tag categories group related tags together for easier management and navigation. Categories are optional but recommended for organizations with many tags.

To create or manage categories, use the Categories tab on the Tags Management page. Each category can have its own color scheme to visually distinguish groups of tags.

Applying Tags

Applying to Individual Items

Tags can be applied to identities, objects, and groups from their respective detail pages:

1. Navigate to the detail page of the identity, object, or group
2. Locate the Tags section
3. Click Add Tag
4. Search for and select the tag
5. The tag is applied immediately

Bulk Tag Application

For applying tags to multiple items at once:

1. Navigate to the Objects browser (/admin/directory/objects), People page, or Groups page
2. Use checkboxes to select multiple items
3. Click the Tag action in the bulk operations toolbar
4. Select the tag to apply
5. Confirm the bulk operation

Bulk tagging is useful for scenarios such as:

• Tagging all members of a department as "SOX In-Scope"
• Marking a group of contractor accounts discovered during an access review
• Classifying service accounts identified during a sync

Removing Tags

To remove a tag from an item:

1. Navigate to the item's detail page
2. In the Tags section, click the remove icon next to the tag
3. Confirm the removal

Tags can also be removed in bulk using the same selection workflow described above.

Tag-Based Filtering

Tags integrate with filtering across IdentityCenter, enabling you to quickly narrow down views to tagged populations.

Objects Browser

In the Objects browser at /admin/directory/objects:

• Use the Tags filter to show only objects with a specific tag
• Combine tag filters with attribute filters (e.g., "Show all objects tagged 'High Risk' in the Finance department")
• Save filtered views for quick access

People Page

On the People page:

• Filter by tag to see all identities with a specific classification
• Combine with organizational filters (department, manager, division)
• Export filtered results for reporting

Groups Page

On the Groups page:

• Filter groups by tag to find specifically classified groups
• Identify groups tagged for compliance review

Using Tags for Policy Scoping

One of the most powerful applications of tags is policy scoping. Policies can include or exclude tagged populations:

Including Tagged Populations

Scope a policy to only evaluate items with a specific tag:

Excluding Tagged Populations

Exclude specific tagged items from policy evaluation:

VIP Tag Pattern

A common pattern is the "VIP" tag, which identifies high-profile individuals (executives, board members) who may require special handling:

• Exclude VIPs from automated account disablement policies
• Route VIP access reviews to a senior reviewer
• Generate separate compliance reports for VIP populations
• Apply enhanced monitoring policies to VIP accounts

Tags Diagnostic Page

The Tags Diagnostic page helps troubleshoot tagging issues and provides administrative oversight:

Access the diagnostic page from Tags Management > Diagnostics or via the diagnostic link on the Tags Management page.

Seed Tags

IdentityCenter ships with a set of pre-configured seed tags that cover common identity governance scenarios:

Seed tags can be renamed, recategorized, or deleted if they do not fit your organization's needs.

Integration with Other Features

Tags integrate with several IdentityCenter features beyond filtering and policy scoping:

Best Practices

1. Keep tags consistent - Establish a naming convention and enforce it. Avoid creating tags that overlap in meaning (e.g., "Admin" and "Administrator" and "Privileged").

2. Use categories - Organize tags into categories to prevent tag sprawl. Categories make it easier for administrators to find and apply the right tag.

3. Do not over-tag - Apply tags intentionally. If everything is tagged, the tags lose their value as a filtering mechanism. Reserve tags for meaningful classifications that drive governance actions.

4. Review tag usage regularly - Use the Tags Diagnostic page to identify orphaned tags (defined but never used) and consolidate duplicates.

5. Document tag purpose - Use the description field to explain when a tag should be applied and by whom. This helps maintain consistency as your team grows.

6. Align tags with compliance - Create tags that map to your compliance requirements (e.g., "SOX In-Scope," "PCI Cardholder Data Access") so that policy scoping and reporting are straightforward.

7. Automate where possible - Consider using policies or sync rules to automatically apply tags based on object attributes, reducing manual tagging effort.

Next Steps

• Organization Center - Explore organizational structure alongside tag-based classification
• Policies Overview - Scope policies using tags
• Creating Policies - Build policies that reference tag-based populations
• Access Reviews Overview - Scope access review campaigns by tag
• Compliance Frameworks Overview - Map tags to compliance framework controls