Azure service-tag requirements and limitations
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit dd4fdf2 · +73 −68 lines · also on GitHub
11
---
22
title: Azure service tags overview
33
titlesuffix: Azure Virtual Network
4
−description: Learn about service tags. Service tags help minimize the complexity of security rule creation.
4
+description: Learn about Azure service tags and how they simplify security rule creation for Azure Virtual Networks. Discover benefits and best practices.
55
services: virtual-network
66
author: asudbring
77
ms.service: azure-virtual-network
88
ms.topic: concept-article
9
−ms.date: 04/21/2025
9
+ms.date: 07/15/2025
1010
ms.author: allensu
1111
# Customer intent: "As a network administrator, I want to utilize service tags for defining security rules, so that I can simplify network access controls and maintain effective security management for Azure resources."
1212
---
1313
14
−# Virtual network service tags
14
+# Azure service tags overview for virtual network security
15
+
1516
<a name="network-service-tags"></a>
1617
17
−A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.
18
+A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.
1819
20
+Service tags simplify network security configuration in Azure by:
21
+
22
+- Eliminating the need to manually track and update IP addresses for Azure services
23
+- Providing automatic updates when Azure service IP ranges change
24
+- Reducing the complexity of security rule management
25
+- Enabling granular control over network traffic to and from Azure services
26
+
27
+You can use service tags to define network access controls on [network security groups](./network-security-groups-overview.md#security-rules), [Azure Firewall](../firewall/service-tags.md), and user-defined routes. Use service tags in place of specific IP addresses when you create security rules and routes.
28
+
1929
> [!IMPORTANT]
20
−> While Service Tags simplify the ability to enable IP-based Access Control Lists (ACLs), Service Tags alone aren't sufficient to secure traffic without considering the nature of the service and the traffic it sends. For more information about IP based ACLs, see **[What is an IP based access control list (ACL)?](ip-based-access-control-list-overview.md)**.
30
+> While Service Tags simplify the ability to enable IP-based Access Control Lists (ACLs), Service Tags alone aren't sufficient to secure traffic without considering the nature of the service and the traffic it sends. For more information about IP based ACLs, see **[What is an IP based access control list (ACL)?](ip-based-access-control-list-overview.md)**.
2131
>
22
−> Additional information about the nature of the traffic can be found later in this article for each service and their tag. It's important to ensure you are familiar with the traffic that you allow when utilizing service tags for IP based ACLs. Consider added levels of security to protect your environment.
32
+> Additional information about the nature of the traffic can be found later in this article for each service and their tag. It's important to ensure you're familiar with the traffic that you allow when utilizing service tags for IP based ACLs. Consider added levels of security to protect your environment.
2333
24
−You can use service tags to define network access controls on [network security groups](./network-security-groups-overview.md#security-rules), [Azure Firewall](../firewall/service-tags.md), and user-defined routes. Use service tags in place of specific IP addresses when you create security rules and routes. By specifying the service tag name, such as **ApiManagement**, in the appropriate *source* or *destination* field of a security rule, you can allow or deny the traffic for the corresponding service. By specifying the service tag name in the address prefix of a route, you can route traffic intended for any of the prefixes encapsulated by the service tag to a desired next hop type.
34
+## How service tags work
2535
26
−You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from **Internet** and allow traffic to/from **AzureCloud** or other [available service tags](#available-service-tags) of specific Azure services.
36
+When you specify a service tag name (such as **ApiManagement**) in the appropriate *source* or *destination* field of a security rule, you allow or deny the traffic for the corresponding service. The service tag automatically includes all current and future IP address ranges used by that service.
2737
28
−
38
+You can route traffic intended for any of the prefixes encapsulated by the service tag to a desired next hop type. Specify the service tag name in the address prefix of a route.
2939
40
+### Common use cases
41
+
42
+Service tags help you:
43
+
44
+- **Achieve network isolation**: Protect your Azure resources from the general Internet while accessing Azure services that have public endpoints
45
+- **Simplify security rules**: Create rules without managing individual IP addresses
46
+- **Ensure automatic updates**: Stay current with Azure service IP ranges without manual intervention
47
+
48
+For example, you can create inbound/outbound network security group rules that:
49
+
50
+- Deny traffic to/from **Internet**
51
+- Allow traffic to/from **AzureCloud** or other [available service tags](#available-service-tags) of specific Azure services
52
+
53
+:::image type="content" source="./media/service-tags-overview/service_tags.png" alt-text="Screenshot of network isolation of Azure services using service tags.":::
54
+
3055
## Available service tags
3156
3257
The following table includes all the service tags available for use in [network security group](./network-security-groups-overview.md#security-rules) rules.
⋯ 1 unchanged line
3459
The columns indicate whether the tag:
3560
3661
- Is suitable for rules that cover inbound or outbound traffic.
37
−- Supports [regional](https://azure.microsoft.com/regions) scope.
62
+- Supports [regional](/azure/reliability/regions-list) scope.
3863
- Is usable in [Azure Firewall](../firewall/service-tags.md) rules as a *destination* rule only for inbound or outbound traffic.
3964
40
−By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag **Storage** represents Azure Storage for the entire cloud, but **Storage.WestUS** narrows the range to only the storage IP address ranges from the WestUS region. The following table indicates whether each service tag supports such regional scope, and the direction listed for each tag is a recommendation. For example, the AzureCloud tag may be used to allow inbound traffic. In most scenarios, we don't recommend allowing traffic from all Azure IPs since IPs used by other Azure customers are included as part of the service tag.
65
+By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag **Storage** represents Azure Storage for the entire cloud, but **Storage.WestUS** narrows the range to only the storage IP address ranges from the WestUS region. The following table indicates whether each service tag supports such regional scope, and the direction listed for each tag is a recommendation. For example, the AzureCloud tag might be used to allow inbound traffic. In most scenarios, we don't recommend allowing traffic from all Azure IPs since IPs used by other Azure customers are included as part of the service tag.
4166
4267
| Tag | Purpose | Can use inbound or outbound? | Can be regional? | Can use with Azure Firewall? |
4368
| --- | -------- |:---:|:---:|:---:|
4469
| **[ActionGroup](/azure/azure-monitor/ip-addresses)** | Action Group. | Inbound | No | Yes |
45
−| **ApiManagement** | Management traffic for Azure API Management-dedicated deployments. <br/><br/>**Note**: This tag represents the Azure API Management service endpoint for control plane per region. The tag enables customers to perform management operations on the APIs, Operations, Policies, NamedValues configured on the API Management service. | Inbound | Yes | Yes |
70
+| **ApiManagement** | Management traffic for Azure API Management-dedicated deployments. <br/><br/>**Note**: This tag represents the Azure API Management service endpoint for control plane per region. The tag enables customers to perform management operations on the APIs, Operations, Policies, NamedValues configured on the API Management service. | Inbound | Yes | Yes |
4671
| **[ApplicationInsightsAvailability](/azure/azure-monitor/app/availability-private-test)** | Application Insights Availability. | Inbound | No | Yes |
4772
| **AppConfiguration** | App Configuration. | Outbound | No | Yes |
48
−| **[AppService](/azure/app-service/overview-inbound-outbound-ips)** | Azure App Service. This tag is recommended for outbound security rules to web apps and function apps.<br/><br/>**Note**: This tag doesn't include IP addresses assigned when using IP-based SSL (App-assigned address). | Outbound | Yes | Yes |
73
+| **[AppService](/azure/app-service/overview-inbound-outbound-ips)** | Azure App Service. This tag is recommended for outbound security rules to web apps and function apps.<br/><br/>**Note**: This tag doesn't include IP addresses assigned when using IP-based SSL (App-assigned address). | Outbound | Yes | Yes |
4974
| **[AppServiceManagement](/azure/app-service/environment/management-addresses)** | Management traffic for deployments dedicated to App Service Environment. | Both | No | Yes |
50
−| **AzureActiveDirectory** | Microsoft Entra ID Services. This tag includes login, MS Graph and other Entra services not specifically listed in this table | Outbound | No | Yes |
75
+| **AzureActiveDirectory** | Microsoft Entra ID Services. This tag includes sign-in, MS Graph and other Microsoft Entra services not listed in this table | Outbound | No | Yes |
5176
| **[AzureActiveDirectoryDomainServices](/entra/identity/domain-services/network-considerations#inbound-connectivity)** | Management traffic for deployments dedicated to Microsoft Entra Domain Services. | Both | No | Yes |
5277
| **[AzureAdvancedThreatProtection](/defender-for-identity/deploy/configure-proxy#enable-access-with-a-service-tag)** | Microsoft Defender for Identity. | Outbound | No | Yes |
5378
| **AzureArcInfrastructure** | Azure Arc-enabled servers, Azure Arc-enabled Kubernetes, and Guest Configuration traffic.<br/><br/>**Note**: This tag has a dependency on the **AzureActiveDirectory**,**AzureTrafficManager**, and **AzureResourceManager** tags. | Outbound | No | Yes |
54
−| **AzureAttestation** | Azure Attestation. | Outbound | No | Yes |
79
+| **AzureAttestation** | Azure Attestation. | Outbound | No | Yes |
5580
| **[AzureBackup](/azure/backup/backup-sql-server-database-azure-vms#establish-network-connectivity)** |Azure Backup.<br/><br/>**Note**: This tag has a dependency on the **Storage** and **AzureActiveDirectory** tags. | Outbound | No | Yes |
5681
| **AzureBotService** | Azure Bot Service. | Both | No | Yes |
5782
| **AzureCloud** | All [datacenter public IP addresses](https://www.microsoft.com/download/details.aspx?id=56519). This tag doesn't include IPv6. | Both | Yes | Yes |
⋯ 19 unchanged lines
77102
| **AzureOpenDatasets** | Azure Open Datasets.<br/><br/>**Note**: This tag has a dependency on the **AzureFrontDoor.Frontend** and **Storage** tag. | Outbound | No | Yes |
78103
| **AzurePlatformDNS** | The basic infrastructure (default) DNS service.<br/><br/>You can use this tag to disable the default DNS. Be cautious when you use this tag. We recommend that you read [Azure platform considerations](./network-security-groups-overview.md#azure-platform-considerations). We also recommend that you perform testing before you use this tag. | Outbound | No | No |
79104
| **[AzurePlatformIMDS](/azure/virtual-network/network-security-groups-overview#azure-platform-considerations)** | Azure Instance Metadata Service (IMDS), which is a basic infrastructure service.<br/><br/>You can use this tag to disable the default IMDS. Be cautious when you use this tag. We recommend that you read [Azure platform considerations](./network-security-groups-overview.md#azure-platform-considerations). We also recommend that you perform testing before you use this tag. | Outbound | No | No |
80
−| **AzurePlatformLKM** | Windows licensing or key management service.<br/><br/>You can use this tag to disable the defaults for licensing. Be cautious when you use this tag. We recommend that you read [Azure platform considerations](./network-security-groups-overview.md#azure-platform-considerations). We also recommend that you perform testing before you use this tag. | Outbound | No | No |
105
+| **AzurePlatformLKM** | Windows licensing or key management service.<br/><br/>You can use this tag to disable the defaults for licensing. Be cautious when you use this tag. We recommend that you read [Azure platform considerations](./network-security-groups-overview.md#azure-platform-considerations). We also recommend that you perform testing before you use this tag. | Outbound | No | No |
81106
| **[AzureResourceManager](/azure/azure-resource-manager/management/service-tags)** | Azure Resource Manager. | Outbound | No | Yes |
82107
| **[AzureSentinel](/AZURE/sentinel/define-playbook-access-restrictions)** | Microsoft Sentinel. | Inbound | No | Yes |
83108
| **[AzureSignalR](/azure/azure-signalr/howto-service-tags)** | Azure SignalR. | Outbound | No | Yes |
84109
| **AzureSiteRecovery** | Azure Site Recovery.<br/><br/>**Note**: This tag has a dependency on the **AzureActiveDirectory**, **AzureKeyVault**, **EventHub**,**GuestAndHybridManagement** and **Storage** tags. | Outbound | No | Yes |
85
−| **[AzureSphere](/azure-sphere/network/restrict-vnet-service-tag)** | This tag or the IP addresses covered by this tag can be used to restrict access to Azure Sphere Security Services. | Both | No | Yes |
110
+| **[AzureSphere](/azure-sphere/network/restrict-vnet-service-tag)** | This tag or the IP addresses covered by this tag can be used to restrict access to Azure Sphere Security Services. | Both | No | Yes |
86111
| **[AzureSpringCloud](/azure/spring-apps/enterprise/concept-security-controls)** | Allow traffic to applications hosted in Azure Spring Apps. | Outbound | No | Yes |
87112
| **AzureStack** | Azure Stack Bridge services. <br/> This tag represents the Azure Stack Bridge service endpoint per region. | Outbound | No | Yes |
113
+<<<<<<< HEAD
114
+| **AzureTrafficManager** | Azure Traffic Manager probe IP addresses.<br/><br/>For more information on Traffic Manager probe IP addresses, see [Azure Traffic Manager FAQ](../traffic-manager/traffic-manager-faqs.md). | Inbound | No | Yes |
115
+| **AzureUpdateDelivery** | The Azure Update Delivery service tag used for accessing Windows Updates is marked for deprecation and in the future will be decommissioned.</br></br> Customers are advised to not take a dependency on this service tag and for customers already using it they're advised to migrate to one of the following options: </br></br>Configure Azure Firewall for your Windows 10/11 devices as documented: </br></br> • **[Manage connection endpoints for Windows 11 Enterprise](/windows/privacy/manage-windows-11-endpoints)** </br></br> • **[Manage connection endpoints for Windows 10 Enterprise, version 21H2](/windows/privacy/manage-windows-21h2-endpoints)** </br></br> Deploy the Windows Server Update Services (WSUS) </br></br> **[Plan deployment for updating Windows VMs in Azure](/azure/architecture/example-scenario/wsus/)** then proceed to </br> **[Step 2: Configure WSUS](/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-configure-your-firewall-to-allow-your-first-wsus-server-to-connect-to-microsoft-domains-on-the-internet)** | Outbound | No | Yes |
116
+=======
88117
| **AzureTrafficManager** | Azure Traffic Manager probe IP addresses.<br/><br/>For more information on Traffic Manager probe IP addresses, see [Azure Traffic Manager FAQ](../traffic-manager/traffic-manager-faqs.md). | Inbound | No | Yes |
89118
| **AzureUpdateDelivery** | The Azure Update Delivery service tag used for accessing Windows Updates is deprecated. </br></br> Customers are advised to not take a dependency on this service tag and for customers already using it they are advised to migrate to one of the following options: </br></br>Configure Azure Firewall for your Windows 10/11 devices as documented: </br></br> • **[Manage connection endpoints for Windows 11 Enterprise](/windows/privacy/manage-windows-11-endpoints)** </br></br> • **[Manage connection endpoints for Windows 10 Enterprise, version 21H2](/windows/privacy/manage-windows-21h2-endpoints)** </br></br> Deploy the Windows Server Update Services (WSUS) </br></br> **[Plan deployment for updating Windows VMs in Azure](/azure/architecture/example-scenario/wsus/)** then proceed to </br> **[Step 2: Configure WSUS](/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-configure-your-firewall-to-allow-your-first-wsus-server-to-connect-to-microsoft-domains-on-the-internet)**</br></br>For more information, see [Changes coming to the Azure Update Delivery service tag](https://techcommunity.microsoft.com/blog/windows-itpro-blog/changes-coming-to-the-azure-update-delivery-service-tag/4156552) | Outbound | No | Yes |
119
+>>>>>>> 6d89cae9bec4329acb3dd0218327e91805154309
90120
| **AzureWebPubSub** | AzureWebPubSub | Both | Yes | Yes |
91121
| **[BatchNodeManagement](/azure/batch/batch-virtual-network)** | Management traffic for deployments dedicated to Azure Batch. | Both | Yes | Yes |
92122
| **[ChaosStudio](/azure/chaos-studio/chaos-studio-permissions-security)** | Azure Chaos Studio. <br/><br/>**Note**: If you have enabled Application Insights integration on the Chaos Agent, the AzureMonitor tag is also required. | Both | No | Yes |
⋯ 14 unchanged lines
107137
| **[LogicAppsManagement](/azure/logic-apps/logic-apps-limits-and-config#firewall-ip-configuration-considerations)** | Management traffic for Logic Apps. | Inbound | No | Yes |
108138
| **[M365ManagementActivityApi](/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api)** | The Office 365 Management Activity API provides information about various user, admin, system, and policy actions and events from Office 365 and Microsoft Entra activity logs. Customers and partners can use this information to create new or enhance existing operations, security, and compliance-monitoring solutions for the enterprise.<br/><br/>**Note**: This tag has a dependency on the **AzureActiveDirectory** tag. | Outbound | Yes | Yes |
109139
| **[M365ManagementActivityApiWebhook](/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api)** | Notifications are sent to the configured webhook for a subscription as new content becomes available. | Inbound | Yes | Yes |
110
−| **MicrosoftAzureFluidRelay** | This tag represents the IP addresses used for Azure Microsoft Fluid Relay Server. </br> **Note**: This tag has a dependency on the **AzureFrontDoor.Frontend** tag. | Both | No | Yes |
140
+| **MicrosoftAzureFluidRelay** | This tag represents the IP addresses used for Azure Microsoft Fluid Relay Server.</br> **Note**: This tag has a dependency on the **AzureFrontDoor.Frontend** tag. | Both | No | Yes |
111141
| **[MicrosoftCloudAppSecurity](/defender-cloud-apps/network-requirements)** | Microsoft Defender for Cloud Apps. | Both | No | Yes |
112
−| **[MicrosoftDefenderForEndpoint](/defender-endpoint/configure-device-connectivity)** | Microsoft Defender for Endpoint core services.<br/><br/>**Note**: Devices need to be onboarded with streamlined connectivity and meet requirements in order to use this service tag. Defender for Endpoint/Server require additional service tags, like OneDSCollector, to support all functionality.<br/></br> For more information, see [Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-device-connectivity) | Both | No | Yes |
142
+| **[MicrosoftDefenderForEndpoint](/defender-endpoint/configure-device-connectivity)** | Microsoft Defender for Endpoint core services.<br/><br/>**Note**: Devices need to be onboarded with streamlined connectivity and meet requirements in order to use this service tag. Defender for Endpoint/Server require more service tags, like OneDSCollector, to support all functionality.<br/></br> For more information, see [Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-device-connectivity) | Both | No | Yes |
113143
| **[PowerBI](/power-bi/enterprise/service-premium-service-tags)** | Power BI platform backend services and API endpoints.<br/><br/> | Both | Yes | Yes |
114144
| **[PowerPlatformInfra](/power-platform/admin/online-requirements)** | This tag represents the IP addresses used by the infrastructure to host Power Platform services. | Both | Yes | Yes |
115145
| **[PowerPlatformPlex](/power-platform/admin/online-requirements)** | This tag represents the IP addresses used by the infrastructure to host Power Platform extension execution on behalf of the customer. | Both | Yes | Yes |
116146
| **[PowerQueryOnline](/data-integration/gateway/service-gateway-communication)** | Power Query Online. | Both | No | Yes |
117
−| **Scuba** | Data connectors for Microsoft security products (Sentinel, Defender, etc.). | Inbound | No | No|
147
+| **Scuba** | Data connectors for Microsoft security products (Microsoft Sentinel, Defender, etc.). | Inbound | No | No|
118148
| **[SerialConsole](/troubleshoot/azure/virtual-machines/linux/serial-console-linux#use-serial-console-with-custom-boot-diagnostics-storage-account-firewall-enabled)** | Limit access to boot diagnostics storage accounts from only Serial Console service tag | Inbound | No | Yes |
119149
| **ServiceBus** | Azure Service Bus traffic. | Outbound | Yes | Yes |
120
−| **[ServiceFabric](/azure/service-fabric/how-to-managed-cluster-networking#bring-your-own-virtual-network)** | Azure Service Fabric.<br/><br/>**Note**: This tag represents the Service Fabric service endpoint for control plane per region. This enables customers to perform management operations for their Service Fabric clusters from their VNET endpoint. (For example, https:// westus.servicefabric.azure.com). | Both | No | Yes |
150
+| **[ServiceFabric](/azure/service-fabric/how-to-managed-cluster-networking#bring-your-own-virtual-network)** | Azure Service Fabric.<br/><br/>**Note**: This tag represents the Service Fabric service endpoint for control plane per region. This enables customers to perform management operations for their Service Fabric clusters from their virtual network endpoint. (For example, https:// westus.servicefabric.azure.com). | Both | No | Yes |
121151
| **Sql** | Azure SQL Database, Azure Database for MariaDB, and Azure Synapse Analytics.<br/><br/>**Note**: This tag represents the service, but not specific instances of the service. For example, the tag represents the Azure SQL Database service, but not a specific SQL database or server. This tag doesn't apply to SQL managed instance. | Outbound | Yes | Yes |
122152
| **SqlManagement** | Management traffic for SQL-dedicated deployments. | Both | No | Yes |
123153
| **[Storage](/azure/storage/file-sync/file-sync-networking-overview#configuring-firewalls-and-service-tags)** | Azure Storage. <br/><br/>**Note**: This tag represents the service, but not specific instances of the service. For example, the tag represents the Azure Storage service, but not a specific Azure Storage account. | Outbound | Yes | Yes |
⋯ 1 unchanged line
125155
| **StorageMover** | Storage Mover. | Outbound | Yes | Yes |
126156
| **[WindowsAdminCenter](/windows-server/manage/windows-admin-center/azure/manage-vm#networking-requirements)** | Allow the Windows Admin Center backend service to communicate with customers' installation of Windows Admin Center. | Outbound | No | Yes |
127157
| **[WindowsVirtualDesktop](/azure/virtual-desktop/required-fqdn-endpoint?tabs=azure#service-tags-and-fqdn-tags)** | Azure Virtual Desktop (formerly Windows Virtual Desktop). | Both | No | Yes |
128
−| **[VideoIndexer](/azure/azure-video-indexer/network-security)** | Video Indexer. </br> Used to allow customers opening up their NSG to Video Indexer service and receive callbacks to their service. | Both | No | Yes |
158
+| **[VideoIndexer](/azure/azure-video-indexer/network-security)** | Video Indexer.</br> Used to allow customers opening up their NSG to Video Indexer service and receive callbacks to their service. | Both | No | Yes |
129159
| **VirtualNetwork** | The virtual network address space (all IP address ranges defined for the virtual network), all connected on-premises address spaces, [peered](virtual-network-peering-overview.md) virtual networks, virtual networks connected to a [virtual network gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%3ftoc.json), the [virtual IP address of the host](./network-security-groups-overview.md#azure-platform-considerations), and address prefixes used on [user-defined routes](virtual-networks-udr-overview.md). This tag might also contain default routes. | Both | No | No |
130160
131161
> [!NOTE]
132
−> - When using service tags with Azure Firewall, you can only create destination rules on inbound and outbound traffic. Source rules are not supported. For more information, see the [Azure Firewall Service Tags](../firewall/service-tags.md) doc.
162
+> - When using service tags with Azure Firewall, you can only create destination rules on inbound and outbound traffic. Source rules aren't supported. For more information, see the [Azure Firewall Service Tags](../firewall/service-tags.md) doc.
133163
>
134
−> - Service tags of Azure services denote the address prefixes from the specific cloud being used. For example, the underlying IP ranges that correspond to the **Sql** tag value on the Azure Public cloud will be different from the underlying ranges on the Microsoft Azure operated by 21Vianet cloud.
164
+> - Service tags of Azure services denote the address prefixes from the specific cloud being used. For example, the underlying IP ranges that correspond to the **Sql** tag value on the Azure Public cloud is different from the underlying ranges on the Microsoft Azure operated by 21Vianet cloud.
135165
>
136166
> - If you implement a [virtual network service endpoint](virtual-network-service-endpoints-overview.md) for a service, such as Azure Storage or Azure SQL Database, Azure adds a [route](virtual-networks-udr-overview.md#optional-default-routes) to a virtual network subnet for the service. The address prefixes in the route are the same address prefixes, or CIDR ranges, as those of the corresponding service tag.
137167
138
−
139168
### Tags supported in the classic deployment model
140169
141170
The classic deployment model (before Azure Resource Manager) supports a small subset of the tags listed in the previous table. The tags in the classic deployment model are spelled differently, as shown in the following table:
⋯ 6 unchanged lines
148177
149178
### Tags unsupported for user defined routes (UDR)
150179
151
−The following is a list of tags currently unsupported for use with user defined routes (UDR).
152
−
153
−* AzurePlatformDNS
154
−
155
−* AzurePlatformIMDS
156
−
157
−* AzurePlatformLKM
158
−
159
−* VirtualNetwork
160
−
161
−* AzureLoadBalancer
180
+The following list of tags is currently unsupported for use with user defined routes (UDR).
162181
163
−* Internet
182
+- AzurePlatformDNS
183
+- AzurePlatformIMDS
184
+- AzurePlatformLKM
185
+- VirtualNetwork
186
+- AzureLoadBalancer
187
+- Internet
164188
165
−## Service tags on-premises
189
+## Service tags on-premises
166190
167191
You can obtain the current service tag and range information to include as part of your on-premises firewall configurations. This information is the current point-in-time list of the IP ranges that correspond to each service tag. You should obtain the information programmatically or via a JSON file download, as described in the following sections.
168192
⋯ 2 unchanged lines
171195
You can programmatically retrieve the current list of service tags together with IP address range details:
172196
173197
- [REST](/rest/api/virtualnetwork/servicetags/list)
174
−
175198
- [Azure PowerShell](/powershell/module/az.network/Get-AzNetworkServiceTag)
176
−
177199
- [Azure CLI](/cli/azure/network#az-network-list-service-tags)
178200
179
−For example, to retrieve all the prefixes for the Storage Service Tag, you can use the following PowerShell cmdlets:
201
+For example, to retrieve all the prefixes for the Storage Service Tag, you can use the following PowerShell cmdlets:
180202
181203
```azurepowershell-interactive
182204
$serviceTags = Get-AzNetworkServiceTag -Location eastus2
⋯ 2 unchanged lines
185207
```
186208
187209
> [!NOTE]
188
−>
189
−> - The API data represents those tags that can be used with NSG rules in your region. Use the API data as the source of truth for available Service Tags as it may be different than the JSON downloadable file.
190
−> - It takes up to 4 weeks for new Service Tag data to propagate in the API results across all Azure regions. Because of this process, your API data results may be out of sync with the downloadable JSON file as the API data represents a subset of the tags currently in the downloadable JSON file.
191
−> - You must be authenticated and have a role with read permissions for your current subscription.
210
+> - The API data represents those tags that can be used with NSG rules in your region. Use the API data as the source of truth for available Service Tags as it might be different than the JSON downloadable file.
211
+> - It takes up to four weeks for new Service Tag data to propagate in the API results across all Azure regions. Because of this process, your API data results might be out of sync with the downloadable JSON file as the API data represents a subset of the tags currently in the downloadable JSON file.
212
+> - You must be authenticated and have a role with read permissions for your current subscription.
192213
193
−### Discover service tags by using downloadable JSON files
214
+### Discover service tags by using downloadable JSON files
194215
195216
You can download JSON files that contain the current list of service tags together with IP address range details. These lists are updated and published weekly. Locations for each cloud are.
196217
197218
- [Azure Public](https://www.microsoft.com/download/details.aspx?id=56519)
198
−
199
−- [Azure US Government](https://www.microsoft.com/download/details.aspx?id=57063)
200
−
201
−- [Microsoft Azure operated by 21Vianet](https://www.microsoft.com/download/details.aspx?id=57062)
202
−
203
−- [Azure Germany](https://www.microsoft.com/download/details.aspx?id=57064)
219
+- [Azure US Government](https://www.microsoft.com/download/details.aspx?id=57063)
220
+- [Microsoft Azure operated by 21Vianet](https://www.microsoft.com/download/details.aspx?id=57062)
221
+- [Azure Germany](https://www.microsoft.com/download/details.aspx?id=57064)
204222
205
−The IP address ranges in these files are in CIDR notation.
223
+The IP address ranges in these files are in CIDR notation.
206224
207
−The following AzureCloud tags don't have regional names formatted according to the normal schema:
225
+The following AzureCloud tags don't have regional names formatted according to the normal schema:
208226
209227
- AzureCloud.centralfrance (FranceCentral)
210
−
211228
- AzureCloud.southfrance (FranceSouth)
212
−
213229
- AzureCloud.germanywc (GermanyWestCentral)
214
−
215230
- AzureCloud.germanyn (GermanyNorth)
216
−
217231
- AzureCloud.norwaye (NorwayEast)
218
−
219232
- AzureCloud.norwayw (NorwayWest)
220
−
221233
- AzureCloud.switzerlandn (SwitzerlandNorth)
222
−
223234
- AzureCloud.switzerlandw (SwitzerlandWest)
224
−
225235
- AzureCloud.usstagee (EastUSSTG)
226
−
227236
- AzureCloud.usstagec (SouthCentralUSSTG)
228
−
229237
- AzureCloud.brazilse (BrazilSoutheast)
230238
231239
> [!TIP]
232
−>
233240
> - You can detect updates from one publication to the next by noting increased *changeNumber* values in the JSON file. Each subsection (for example, **Storage.WestUS**) has its own *changeNumber* that's incremented as changes occur. The top level of the file's *changeNumber* is incremented when any of the subsections is changed.
234
−>
235241
> - For examples of how to parse the service tag information (for example, get all address ranges for Storage in WestUS), see the [Service Tag Discovery API PowerShell](/powershell/module/az.network/Get-AzNetworkServiceTag) documentation.
236
−>
237
−> - When new IP addresses are added to service tags, they won't be used in Azure for at least one week. This gives you time to update any systems that might need to track the IP addresses associated with service tags.
242
+> - When new IP addresses are added to service tags, they aren't used in Azure for at least one week. This process gives you time to update any systems that might need to track the IP addresses associated with service tags.
238243
239244
## Next steps
240245
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.