Azure-docs: Does "AzureCloud" IP range include all Azure IPs and tag like "Storage", "AppService"?

[jinzejian]

1. Does "AzureCloud" tag includes all Azure resources' public IP? If not, does it overlap (or include) with other tag such as "AppService"?
2. What tag should Azure FrontDoor IPs belong to?
3. Given a specific Azure IP, how can we identify which tag it belongs to?

I'm asking this because our customer thought whitelisting "AzureCloud" would whitelist all Azure IPs, but got problem that certain services got blocked (which works before when whitelisting "AzureCloud"), and found it's due to a set of new Azure IPs got blocked. Some of the IPs I found belongs to Azure Front Door and not in "AzureCloud" tag.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 5e905802-0b08-4b3b-25ec-0f88c023bc32
• Version Independent ID: f31325e5-49ea-b28c-336e-10f2a3fc12b4
• Content: Azure security groups overview
• Content Source: articles/virtual-network/security-overview.md
• Service: virtual-network
• GitHub Login: @malopMSFT
• Microsoft Alias: malop;kumud

[Karishma-Tiwari-MSFT]

Thanks for the question. We are currently investigating and will update you shortly.

[TravisCragg-MSFT]

@jinzejian

1. You are correct, the AzureCloud tag is all azure public IP ranges, which includes many other service tags.
2. If you would like to specify the Azure FrontDoor IP Ranges, you can find them Here.
3. If you would like to figure out what tag it belongs to / what service it came from, you can match it to the IP Ranges and Service Tags list.

The IP Ranges and Service Tags list should contain everything you need.

[jinzejian]

Hi Travis, thanks for the information. Take "13.107.246.0/24" for example, it belongs to name" AzureFrontDoor.Frontend" and systemService "AzureFrontDoor", but I don't see such tag in NSG. Would you let me know what tag suites "13.107.246.0/24"?

Thanks.

[TravisCragg-MSFT]

@jinzejian Azure FrontDoor does not have a service tag at this time. It will be integrated into the Azure Cloud service tag in the near future, and get it's own service tag.

[jinzejian]

Thanks Travis for the reply. Which means "AzureCloud tag is all azure public IP ranges" is not entirely correct currently, right?

Also, which tag should these IP belongs to (or will belong to), I checked they do belongs to Azure
65.55.163.x

Thanks.

[TravisCragg-MSFT]

@jinzejian The published IP Ranges are in the JSON Doc. I am unsure outside of what is published there unfortunately.

[jinzejian]

Thanks Travis. Per "Azure FrontDoor does not have a service tag at this time. It will be integrated into the Azure Cloud service tag in the near future, and get it's own service tag." Do we have a ETA that can be shared with our customer?

[TravisCragg-MSFT]

@jinzejian Unfortunately no, I cannot state a time that it will be ready at this time.

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[jispar]

Hello @jinzejian - we are currently working on enabling AFD service tag for NSG. Rough ETA is Q3'19. Thank you.

[jinzejian]

Noted, thanks @jispar !