Hi there! I'm glad you liked my article. It's always nice to get responses of people learning from what I wrote! 🙏🏻

Regarding your query; sure! You could create a Logic App which is triggered with every incident which looks for the Azure tags in a similar fashion as what I described in the article.

You still have to use the same API request to pull ALL tags, since there doesn't seem to be a different API for pulling in a specific key:value pair. (see: https://learn.microsoft.com/en-us/rest/api/resources/tags?view=rest-resources-2021-04-01)

But with the parse output step you can only pull the value of a specific tag (i.e. "client") and use the value later down in your workflow.

Lastly, there's a Logic App step for Sentinel named "Update Incident" where you can add tags to an incident. You can simply use the tag value from parse step earlier and use that as the tag value for your incident for example.

Hope this helps!