For example, the AzureCloud tag may be used to allow inbound traffic. Note that the direction listed for each tag is a recommendation. The following table indicates whether each service tag supports such regional scope. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region.

Is suitable for rules that cover inbound or outbound traffic.īy default, service tags reflect the ranges for the entire cloud.

The following table includes all the service tags available for use in network security group rules. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.

You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. This feature is currently in Public Preview. As of March 2021, you can also use Service Tags in place of explicit IP ranges in user defined routes.

Service tag to express code