--- title: "Use of Tags" slug: "use-of-tags-v6-7" description: "Learn how to effectively use Tags in AppGate ZTNA for managing objects, policies, and user roles to streamline administration and enhance security." updated: 2026-03-13T18:05:44Z published: 2026-04-03T16:41:09Z canonical: "support.appgate.com/use-of-tags-v6-7" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Use of Tags There are a number of areas in which it is useful to use tags in the AppGate ZTNA system. Many forms in the admin UI allow you to add tags, usually in the area at the top of the page. Tags are a free text field and are common across the entire system. They can be used to find objects and establish relationships between different objects in the system. They are most useful where you need to set up many-to-one relationships. If a number of objects were all tagged with *mytag*, then to allow an admin to manage all these objects would only require *mytag* adding to the admin role. ## Managing tags Tags can be added in most areas by clicking <+ Add New> under Tags. As you start to type, a filtered dropdown list of the existing tags will appear. If a new tag is required click enter the required details and then click . Once tags have been used somewhere in AppGate ZTNA, they will be listed in [System > Tags](/v1/docs/configure-tags-v6-7). This form allows you to manage tags such as change a tags color or delete unused tags. There is also an overview for each tag which shows you all the occurrences of the tag within the system from where it is also possible to edit the tag. This same overview can also be accessed by clicking on the tag anywhere in the system. ## Using tags ### When using Search Most pages offer [search](/v1/docs/admin-ui-v6-7) which includes filtering by *Tags*. This will return only objects with that tag name. ![Search interface for admin roles with fields for keywords, name, and tags.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/search_by_tag.png?sv=2026-02-06&spr=https&st=2026-10-26T22%3A49%3A28Z&se=2026-10-26T23%3A49%3A28Z&sr=c&sp=r&sig=x3%2FsSsgHfPw58UyVwCTHGVFeF9gyiU%2FP8uGnprhYRCw%3D) If you always tag objects when you create them, then it will make it much easier to filter and find these objects later on. This is especially important as the scale of the deployment grows and you have far more objects than can be displayed on one page. ### When adding entitlements to policies It is frequently the case that there will be several entitlements in a single policy, tags are a good way to configure this. As you create the entitlements, make sure to add a tag to each, for example, *Sales*. When you define the policy's [assignment criteria](/v1/docs/configure-policies-v6-7#assignment-criteria), instead of selecting all the entitlements one by one using *Entitlements by Name*, use *Entitlements by Tag* and just add the *Sales* tag there. This will link all the entitlements you have tagged with *Sales* to the policy. There is no requirement to enter anything in the *Tags* field at the bottom of the **Policies** screen in this situation. ### When assigning users to policies Another scenario is when you want to link many users to a single policy. This however only applies to users in the Local Database identity provider type. To add users to the local database, use [Local Users](/v1/docs/local-users-v6-7) and add a tag to each, such as “admin”. Then when you configure a policy, use the list under *Select Assignment Criteria* to select User claims > tags. ![Criteria settings for user assignment based on username and tag type.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/policy_assignment_criteria.png?sv=2026-02-06&spr=https&st=2026-10-26T22%3A49%3A28Z&se=2026-10-26T23%3A49%3A28Z&sr=c&sp=r&sig=x3%2FsSsgHfPw58UyVwCTHGVFeF9gyiU%2FP8uGnprhYRCw%3D) Enter the name of the tag - in this case admin. This will make the policy return true for any user you have tagged with admin. There is no requirement to enter anything in the *Tags* field at the top of the **Policies** screen for this use case. > [!NOTE] > **NOTE** > > For other identity providers, instead of using tags to assign users you can map an attribute (from the IdP) to a new user claim; then pick that user claim in the policy. ### When applying access control to entitlements Access control can optionally be applied by the Gateway when the user/device tries to use any of the actions defined in an entitlement. This is probably not the best-fit use case for tags, however [condition based access](/v1/docs/access-control-modes-v6-7) offers this capability as part of its comprehensive tool set. Follow the same procedure as detailed above for policy assignment when setting up the condition's [access criteria](/v1/docs/configure-conditions-v6-7). There is no requirement to enter anything in the *Tags* field at the top of the conditions screen in this use case. ### When configuring admin roles Tags also play a key part in limiting the scope of administrator privileges. This, in part, is how the concept of delegated administration within AppGate ZTNA was conceived. Refer to [Admin Roles](/v1/docs/admin-roles-v6-7) for more general information about configuring admin access to the system. Unlike the previous use cases where tags were only applied to entitlements or users, tags can (and should) be used everywhere in the system. Then when an admin role is created, it will be possible to limit the *Scope of Privilege* to objects tagged with *mytag*. ![Edit privileges for entitlement with options for limiting scope and adding tags.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/priv_by_tag.png?sv=2026-02-06&spr=https&st=2026-10-26T22%3A49%3A28Z&se=2026-10-26T23%3A49%3A28Z&sr=c&sp=r&sig=x3%2FsSsgHfPw58UyVwCTHGVFeF9gyiU%2FP8uGnprhYRCw%3D) It is also possible to tag admin roles in the same way as other objects to delegate administration of the administration roles themselves. In this case select *Admin Role* for the ***Target Item*** and then Limit the Scope of Privilege using tags that you have assigned to the administrative roles themselves. ![Admin role privileges settings with options for limiting scope by name and tag.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/admin_role_by_tag.png?sv=2026-02-06&spr=https&st=2026-10-26T22%3A49%3A28Z&se=2026-10-26T23%3A49%3A28Z&sr=c&sp=r&sig=x3%2FsSsgHfPw58UyVwCTHGVFeF9gyiU%2FP8uGnprhYRCw%3D)