Tag Manager - Custom Azure RBAC role

TagManagerRole.json

{
   "Name": "Tag Manager Role",
   "Description": "Can only add/edit/delete resource tags",
   "Id": null,
   "IsCustom": true,
   "Actions": [
      "*/read",
      "Microsoft.Resources/tags/write",
      "Microsoft.Resources/tags/delete"
   ],
  "dataActions": [],
  "notActions": [],
  "notDataActions": [],
   "AssignableScopes": [
      "/subscriptions/1e1dcefc-d832-4de0-889a-2a48494c441b"
   ]
}

This custom RBAC role extends the "Reader" role with the access to manager resource Tags.
To apply this to your subscrption(s), download the file and change the "AssignableScopes" to the Guid(s) of your Azure subscriptions.

Then run the Azure CLI commands

az login
az role definition create --role-definition @TagManagerRole.json

to validate the role definition run

az role definition list -n "Tag Manager Role"

You can then assign the role via the Azure portal or CLI