It turns out you can't filter on both resource type and tags at the same
time, which means checking type needs to happen in code. Additionally,
you can't request provisioning state because populating $expand also
does bad things when using tags in filters.