Data Access-Add/Remove Enrichment Tags

Overview

Enrichment Tags are a new data access type on a role. Instead of hand-picking the linked accounts a role can see, you select enrichment tag values and Umbrella resolves the matching linked accounts (AWS linked accounts, Azure subscriptions, GCP projects) in the background. As your enrichment tag file is updated, matching accounts are added and removed automatically - the role's data scope stays in sync with the business reality encoded in your tags.

Enrichment Tags sit alongside Accounts, Cost Centers, and Pipelines on the Data Access tab, and are available both when creating a role and when editing one.

How matching works

• Within a tag: selecting multiple values combines with OR. Env = Dev, QA matches any linked account tagged Dev or QA.
• Across tags: multiple assigned tags combine with AND. A role with both Env = Dev and Team = CS only sees linked accounts tagged with both.
• Dynamic resolution: matching linked accounts are evaluated against the current state of your enrichment tag file. Each time the file is reloaded or updated, the role's accessible accounts are recomputed. The last Last resolved timestamp sits in the top-right of the Enrichment Tags panel.
• Resilient resync: if an enrichment tag update fails mid-process, the role's previous valid mapping is preserved - nothing is deleted on a partial failure.

The in-product How matching works expandable panel repeats these rules alongside the controls.

Assign Enrichment Tags during role creation

Role creation is a five-step wizard: Details → Sub Roles → Permissions → Data Access → Users. Enrichment Tags are configured on step 4.

1. Reach the Data Access step. On step 4 of the wizard, the left nav shows four Data Access types: Accounts, Cost Centers, Pipelines, and Enrichment Tags. Click Enrichment Tags.
2. Pick a tag. Open the tag picker and choose a tag by name (e.g. Env). The picker shows every tag available in your enrichment tag file with the count of distinct values.
3. Pick one or more values. Open the values dropdown and select one or more values. The dropdown shows a running count (e.g. 1 selected). Values combine with OR within a tag.
4. Click Assign accounts. Umbrella resolves the matching linked accounts in the background. A "Assigning accounts in the background. This can take up to a minute." message is shown while resolution runs.
5. Review the matches. When resolution completes, the matching linked accounts appear in the table below with Linked Account, Linked Account ID, and Payer Account. If nothing matches, the table shows "No linked accounts match these tags right now."
6. Add more tags (optional). Repeat steps 2-5 to assign additional tags. The counter at the top of the panel (Assigned Enrichment Tags (N)) tracks the total, and each assigned condition appears as a chip above the controls (e.g. Env = Dev, Team = CS). Additional tags narrow the match set (AND).
7. Click Next to continue to the Users step and finish role creation.

Edit Enrichment Tags on an existing role

Enrichment Tag assignments can be adjusted on any existing role.

1. Open the role. Go to Organization → Roles, open the role, and switch to the Data Access tab.
2. Open the Enrichment Tags sub-section. Click Enrichment Tags in the left nav.
3. Review current assignments. Already-assigned conditions appear as chips above the controls, and the matching linked account table shows the current scope. The Last resolved timestamp indicates when the role was last re-evaluated against the enrichment tag file.
4. Add a tag. Pick a tag and value(s), then click Assign accounts. Background resolution runs for up to a minute.
5. Remove a tag. Click the chip's remove control to drop that condition. The matching account set recomputes.
6. Close when done. Changes are saved as you assign and remove tags.