Azure IP Ranges & Service Tags

Azure Service Tags

Microsoft Azure uses Service Tags — named groups of IP address prefixes that represent a service or group of services. In Azure Network Security Groups (NSGs) and Azure Firewall, you can use service tags directly instead of specifying individual IP ranges. Azure automatically keeps these tags up to date as service IPs change.

Microsoft publishes the full list of service tags and their IP ranges as a weekly JSON download from the Microsoft Download Center. The complete machine-readable data is available on Microsoft's Download Center.

Key Azure Service Tags

Notable Azure IP Ranges

Representative ranges — Azure IPs change frequently. Always use Service Tags in production NSG rules.

Example: NSG Rule Using Service Tags

In an Azure Network Security Group, you can reference a service tag directly instead of managing a list of IP ranges. Azure keeps the tag's prefixes up to date automatically.

# Allow inbound HTTPS from Azure Load Balancer probes
{
  "name": "Allow-AzureLoadBalancer",
  "priority": 100,
  "direction": "Inbound",
  "access": "Allow",
  "protocol": "Tcp",
  "sourceAddressPrefix": "AzureLoadBalancer",
  "destinationAddressPrefix": "*",
  "destinationPortRange": "443"
}

# Allow inbound from all of Azure Cloud (East US region only)
{
  "name": "Allow-AzureCloud-EastUS",
  "priority": 200,
  "direction": "Inbound",
  "access": "Allow",
  "protocol": "*",
  "sourceAddressPrefix": "AzureCloud.EastUS",
  "destinationAddressPrefix": "*",
  "destinationPortRange": "*"
}