Both scopes share the managed-by tag key (vm-dashboard for resources the dashboard provisioned, dashboard-sandbox for the sandbox baseline). AWS requires that key activated as a cost-allocation tag in the Billing console (forward-only; ~24h to populate) — activation is per key, so one activation covers both scopes. Unattributed is spend no tag can reach: GCP Cloud Router/NAT accept no labels, Azure tags don't inherit to disks/NICs/ACI (enable Cost Management tag inheritance to fix), and the OCI Usage API ignores freeform tags — OCI is scoped by compartment instead, so its sandbox figure includes dashboard-provisioned resources in the same compartment.