The basic infrastructure (default) DNS service. Note: This tag has a dependency on the AzureFrontDoor.Frontend and Storage tag. If Linux agents are used, GuestAndHybridManagement tag is also required.ДЄzure Open Datasets. Note: For Log Analytics, the Storage tag is also required. Log Analytics, Application Insights, AzMon, and custom metrics (GiG endpoints). If you're not using Azure Load Balancer, you can override this rule. This only includes probe traffic, not real traffic to your backend resource. The tag translates to the virtual IP address of the host (168.63.129.16) where the Azure health probes originate. Note: This tag has a dependency on the AzureActiveDirectory tag. Note: This tag has a dependency on the AzureActiveDirectory, AzureFrontDoor.Frontend and AzureFrontDoor.FirstParty tags.ДЄzure Key Vault. This tag is not currently configurable via Azure portal.ДЄzureFrontDoor.Frontend AzureFrontDoor.Backend AzureFrontDoor.FirstPartyДЄzure Information Protection. Note: This tag or the IP addresses covered by this tag can be used to restrict access to endpoints configured for event routes. Note: This tag is not currently configurable via Azure portal.ДЄzure Digital Twins. This tag represents the IP addresses used for managed connectors that make inbound webhook callbacks to the Azure Logic Apps service and outbound calls to their respective services, for example, Azure Storage or Azure Event Hubs.ДЄzure Dev Ops. Note: The IP of the search service is not included in the list of IP ranges for this service tag and also needs to be added to the IP firewall of data sources. Refer to the indexer connection documentation for more details. This tag or the IP addresses covered by this tag can be used to grant indexers secure access to data sources. Note: This tag has a dependency on the Storage and AzureActiveDirectory tags.ДЄzure Cognitive Search. Note: This tag is not currently configurable via Azure portal.ДЄzure Backup. This tag is not currently configurable via Azure portal.ДЄzure Attestation. Note: This tag has a dependency on the AzureActiveDirectory, AzureTrafficManager, and AzureResourceManager tags. Management traffic for deployments dedicated to Azure Active Directory Domain Services.ДЄzure Arc-enabled servers, Azure Arc-enabled Kubernetes, and Guest Configuration traffic. Management traffic for deployments dedicated to App Service Environment. This tag is recommended for outbound security rules to web apps and Function apps. This enables customers to perform management operations on the APIs, Operations, Policies, NamedValues configured on the API Management service.ДЄzure App Service. Note: This tag represents the Azure API Management service endpoint for control plane per region. Management traffic for Azure API Management-dedicated deployments. However, we don't recommend this in most scenarios since this means allowing traffic from all Azure IP's, including those used by other Azure customers. For example, the AzureCloud tag may be used to allow inbound traffic. Note that the direction listed for each tag is a recommendation. The following table indicates whether each service tag supports such regional scope. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. Is suitable for rules that cover inbound or outbound traffic.Д«y default, service tags reflect the ranges for the entire cloud.The following table includes all the service tags available for use in network security group rules. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services. You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. This feature is currently in Public Preview. As of March 2021, you can also use Service Tags in place of explicit IP ranges in user defined routes.

Service tag cmd