We would like enforce tagging of resources via Policy but run into edge cases that cause issues. For example, creating a new VM via powershell (New-AzVM) throws an error that BGInfo extension can not be installed due to Policy. When I try to manually add the BGInfo extension, I can not, because I can not create it with Tags and therefore, can not be created due to Policy.