fix issues

Author: tfitzmac

articles/azure-resource-manager/management/tag-resources.md

@@ -4,7 +4,7 @@ description: Shows how to apply tags to organize Azure resources for billing and
 ms.topic: conceptual
 ms.date: 03/20/2020
 ---
-# Use tags to organize your Azure resources, resource groups, and subscriptions
+# Use tags to organize your Azure resources and management hierarchy
 
 You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name "Environment" and the value "Production" to all the resources in production.
 
@@ -14,7 +14,9 @@ For recommendations on how to implement a tagging strategy, see [Resource naming
 
 ## Required access
 
-To apply tags to resources, the user must have write access to that resource type. To apply tags to all resource types, use the [Contributor](../../role-based-access-control/built-in-roles.md#contributor) role. To apply tags to only one resource type, use the contributor role for that resource. For example, to apply tags to virtual machines, use the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor).
+To apply tags to a resource, you must have write access to the **Microsoft.Resources/tags** resource type. The **Tag Contributor** role lets you apply tags to an entity without having access to the entity itself.
+
+The [Contributor](../../role-based-access-control/built-in-roles.md#contributor) role also grants the required access to apply tags to any entity. To apply tags to only one resource type, use the contributor role for that resource. For example, to apply tags to virtual machines, use the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor).
 
 ## PowerShell
 
@@ -152,10 +154,6 @@ $resource = Get-AzResource -ResourceName sqlDatabase1 -ResourceGroupName example
 $resource | ForEach-Object { Update-AzTag -Tag @{ "Dept"="IT"; "Environment"="Test" } -ResourceId $_.ResourceId -Operation Merge }
 ```
 
-### Inherit tags
-
-Tags applied to the resource group or subscription aren't inherited by the resources. To apply tags from a subscription or resource group to the resources, see [Azure Policies - tags](tag-policies.md).
-
 ### List tags
 
 To get the tags for a resource, resource group, or subscription, use the [Get-AzTag](/powershell/module/az.resources/get-aztag) command and pass in the resource ID for the entity.
@@ -258,10 +256,6 @@ az group update -n examplegroup --set tags.'Status'='Approved'
 
 Currently, Azure CLI doesn't support applying tags to subscriptions.
 
-### Inherit tags
-
-Tags applied to the resource group or subscription aren't inherited by the resources. To apply tags from a subscription or resource group to the resources, see [Azure Policies - tags](tag-policies.md).
-
 ### List tags
 
 To see the existing tags for a resource, use:
@@ -563,6 +557,10 @@ To work with tags through the Azure REST API, use:
 * [Tags - Get At Scope](/rest/api/resources/tags/getatscope) (GET operation)
 * [Tags - Delete At Scope](/rest/api/resources/tags/deleteatscope) (DELETE operation)
 
+## Inherit tags
+
+Tags applied to the resource group or subscription aren't inherited by the resources. To apply tags from a subscription or resource group to the resources, see [Azure Policies - tags](tag-policies.md).
+
 ## Tags and billing
 
 You can use tags to group your billing data. For example, if you're running multiple VMs for different organizations, use the tags to group usage by cost center. You can also use tags to categorize costs by runtime environment, such as the billing usage for VMs running in the production environment.

articles/azure-resource-manager/management/toc.yml

@@ -68,11 +68,11 @@
     items:
     - name: Decision guide
       href: /azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json
-    - name: Tag resources
+    - name: Use tags
       href: tag-resources.md
     - name: Policies - compliance
       href: tag-policies.md
-    - name: Tag support
+    - name: Supported resource types
       href: tag-support.md
   - name: Manage resource groups
     items:

includes/resource-manager-tag-resources.md

@@ -10,6 +10,8 @@
  ms.custom: include file
 ---
 
+If a user doesn't have the required access for applying tags, you can assign the **Tag Contributor** role to the user. For more information, see [Tutorial: Grant a user access to Azure resources using RBAC and the Azure portal](../..//role-based-access-control/quickstart-assign-role-user-portal.md).
+
 1. To view the tags for a resource or a resource group, look for existing tags in the overview. If you have not previously applied tags, the list is empty.
 
    ![View tags for resource or resource group](./media/resource-manager-tag-resources/view-tags.png)