For more information about indexers, see indexer connection documentation. This tag or the IP addresses covered by this tag can be used to grant indexers secure access to data sources. Doesn't include IPv6.Īzure Cognitive Search. Note: This tag has a dependency on the Storage and AzureActiveDirectory tags.Īll datacenter public IP addresses. Note: This tag has a dependency on the AzureActiveDirectory, AzureTrafficManager, and AzureResourceManager tags.Īzure Backup. Management traffic for deployments dedicated to Azure Active Directory Domain Services.Īzure Arc-enabled servers, Azure Arc-enabled Kubernetes, and Guest Configuration traffic. Management traffic for deployments dedicated to App Service Environment. Note: This tag doesn't include IP addresses assigned when using IP-based SSL (App-assigned address). This tag is recommended for outbound security rules to web apps and Function apps. The tag enables customers to perform management operations on the APIs, Operations, Policies, NamedValues configured on the API Management service.Īzure App Service. Note: This tag represents the Azure API Management service endpoint for control plane per region. Management traffic for Azure API Management-dedicated deployments. In most scenarios, we don't recommend allowing traffic from all Azure IPs since IPs used by other Azure customers are included as part of the service tag. For example, the AzureCloud tag may be used to allow inbound traffic. The following table indicates whether each service tag supports such regional scope, and the direction listed for each tag is a recommendation. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. Is usable in Azure Firewall rules as a destination rule only for inbound or outbound traffic.īy default, service tags reflect the ranges for the entire cloud.Is suitable for rules that cover inbound or outbound traffic.The following table includes all the service tags available for use in network security group rules. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services. You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. As of March 2022, using service tags in place of explicit address prefixes in user defined routes is out of preview and generally available.

Tag office