AzureNetworkingintermediate

Azure Service Tag Lookup

Look up Azure service tags and their IP ranges for NSG and firewall rules.

CloudToolStack Team6 min readPublished Feb 22, 2026

Prerequisites

Azure networking basics (NSGs, firewalls)
Understanding of IP address ranges and CIDR notation

Search Azure Service Tags

Region

Service Tags

20 tags found

AzureCloud

CloudGlobal

Azure Cloud (Global)

5 IP prefixes|Features: API, NSG, UDR, FW

AzureCloud.EastUS

CloudEastUS

Azure Cloud - East US

4 IP prefixes|Features: API, NSG, UDR, FW

AzureCloud.WestEurope

CloudWestEurope

Azure Cloud - West Europe

5 IP prefixes|Features: API, NSG, UDR, FW

Storage

StorageGlobal

Azure Storage (Global)

4 IP prefixes|Features: API, NSG, UDR, FW, VSE

Storage.EastUS

StorageEastUS

Azure Storage - East US

3 IP prefixes|Features: API, NSG, UDR, FW, VSE

SQL

DatabasesGlobal

Azure SQL (Global)

5 IP prefixes|Features: API, NSG, UDR, FW, VSE

SQL.EastUS

DatabasesEastUS

Azure SQL - East US

3 IP prefixes|Features: API, NSG, UDR, FW, VSE

AzureActiveDirectory

IdentityGlobal

Azure Active Directory

4 IP prefixes|Features: API, NSG, UDR, FW

AzureMonitor

MonitoringGlobal

Azure Monitor

5 IP prefixes|Features: API, NSG, UDR, FW

AzureKeyVault

SecurityGlobal

Azure Key Vault

4 IP prefixes|Features: API, NSG, UDR, FW, VSE

EventHub

MessagingGlobal

Azure Event Hubs

4 IP prefixes|Features: API, NSG, UDR, FW, VSE

ServiceBus

MessagingGlobal

Azure Service Bus

5 IP prefixes|Features: API, NSG, UDR, FW, VSE

AzureContainerRegistry

ContainersGlobal

Azure Container Registry

4 IP prefixes|Features: API, NSG, UDR, FW, VSE

AzureCosmosDB

DatabasesGlobal

Azure Cosmos DB

5 IP prefixes|Features: API, NSG, UDR, FW, VSE

GatewayManager

NetworkingGlobal

Gateway Manager

4 IP prefixes|Features: API, NSG

AzureFrontDoor.Frontend

NetworkingGlobal

Azure Front Door - Frontend

5 IP prefixes|Features: API, NSG, UDR, FW

AzureFrontDoor.Backend

NetworkingGlobal

Azure Front Door - Backend

4 IP prefixes|Features: API, NSG, UDR, FW

BatchNodeManagement

ComputeGlobal

Batch Node Management

4 IP prefixes|Features: API, NSG, UDR, FW

AzureDevOps

DevOpsGlobal

Azure DevOps

5 IP prefixes|Features: API, NSG, UDR, FW

AzureBackup

ManagementGlobal

Azure Backup

4 IP prefixes|Features: API, NSG, UDR, FW

Raw JSON

[
  {
    "name": "AzureCloud",
    "displayName": "Azure Cloud (Global)",
    "region": "Global",
    "category": "Cloud",
    "addressPrefixes": [
      "13.64.0.0/11",
      "13.104.0.0/14",
      "20.33.0.0/16",
      "20.40.0.0/13",
      "40.74.0.0/15"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureCloud.EastUS",
    "displayName": "Azure Cloud - East US",
    "region": "EastUS",
    "category": "Cloud",
    "addressPrefixes": [
      "13.68.128.0/17",
      "13.72.64.0/18",
      "20.42.0.0/17",
      "40.71.0.0/16"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureCloud.WestEurope",
    "displayName": "Azure Cloud - West Europe",
    "region": "WestEurope",
    "category": "Cloud",
    "addressPrefixes": [
      "13.69.0.0/17",
      "13.73.128.0/18",
      "20.50.0.0/18",
      "40.68.0.0/16",
      "51.136.0.0/15"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "Storage",
    "displayName": "Azure Storage (Global)",
    "region": "Global",
    "category": "Storage",
    "addressPrefixes": [
      "20.60.0.0/17",
      "20.150.0.0/15",
      "20.157.0.0/18",
      "52.239.0.0/17"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "Storage.EastUS",
    "displayName": "Azure Storage - East US",
    "region": "EastUS",
    "category": "Storage",
    "addressPrefixes": [
      "20.60.0.0/24",
      "20.150.32.0/23",
      "52.239.152.0/22"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "SQL",
    "displayName": "Azure SQL (Global)",
    "region": "Global",
    "category": "Databases",
    "addressPrefixes": [
      "13.65.31.249/32",
      "13.66.60.72/32",
      "13.86.216.0/25",
      "20.38.144.0/21",
      "40.79.0.0/21"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "SQL.EastUS",
    "displayName": "Azure SQL - East US",
    "region": "EastUS",
    "category": "Databases",
    "addressPrefixes": [
      "20.62.128.0/26",
      "40.71.8.0/26",
      "40.78.224.0/21"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "AzureActiveDirectory",
    "displayName": "Azure Active Directory",
    "region": "Global",
    "category": "Identity",
    "addressPrefixes": [
      "20.190.128.0/18",
      "40.126.0.0/18",
      "52.4.209.250/32",
      "104.46.162.224/27"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureMonitor",
    "displayName": "Azure Monitor",
    "region": "Global",
    "category": "Monitoring",
    "addressPrefixes": [
      "13.65.96.175/32",
      "20.36.114.0/24",
      "20.43.120.0/24",
      "40.80.187.0/24",
      "52.159.127.0/24"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureKeyVault",
    "displayName": "Azure Key Vault",
    "region": "Global",
    "category": "Security",
    "addressPrefixes": [
      "13.66.138.88/30",
      "13.69.226.144/30",
      "20.37.74.224/30",
      "20.45.2.0/23"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "EventHub",
    "displayName": "Azure Event Hubs",
    "region": "Global",
    "category": "Messaging",
    "addressPrefixes": [
      "13.65.209.36/32",
      "13.66.138.64/28",
      "20.150.68.0/24",
      "40.78.226.208/28"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "ServiceBus",
    "displayName": "Azure Service Bus",
    "region": "Global",
    "category": "Messaging",
    "addressPrefixes": [
      "13.66.138.80/29",
      "13.69.226.136/29",
      "20.150.70.0/24",
      "40.78.226.192/28",
      "52.167.107.64/29"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "AzureContainerRegistry",
    "displayName": "Azure Container Registry",
    "region": "Global",
    "category": "Containers",
    "addressPrefixes": [
      "13.66.140.64/29",
      "13.69.228.64/29",
      "20.150.34.0/23",
      "40.78.226.0/25"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "AzureCosmosDB",
    "displayName": "Azure Cosmos DB",
    "region": "Global",
    "category": "Databases",
    "addressPrefixes": [
      "13.66.61.0/26",
      "13.69.227.0/26",
      "20.38.152.0/22",
      "40.78.226.128/26",
      "52.167.106.0/26"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW",
      "VSE"
    ]
  },
  {
    "name": "GatewayManager",
    "displayName": "Gateway Manager",
    "region": "Global",
    "category": "Networking",
    "addressPrefixes": [
      "13.65.64.0/26",
      "13.66.141.64/27",
      "20.36.105.0/24",
      "40.82.248.0/21"
    ],
    "networkFeatures": [
      "API",
      "NSG"
    ]
  },
  {
    "name": "AzureFrontDoor.Frontend",
    "displayName": "Azure Front Door - Frontend",
    "region": "Global",
    "category": "Networking",
    "addressPrefixes": [
      "13.73.248.16/29",
      "20.21.37.40/29",
      "20.36.120.104/29",
      "20.37.64.104/29",
      "40.80.56.104/29"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureFrontDoor.Backend",
    "displayName": "Azure Front Door - Backend",
    "region": "Global",
    "category": "Networking",
    "addressPrefixes": [
      "13.73.248.24/29",
      "20.21.37.48/29",
      "20.36.120.112/29",
      "20.37.64.112/29"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "BatchNodeManagement",
    "displayName": "Batch Node Management",
    "region": "Global",
    "category": "Compute",
    "addressPrefixes": [
      "13.65.192.161/32",
      "13.66.141.32/27",
      "20.36.104.0/24",
      "40.78.226.0/26"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureDevOps",
    "displayName": "Azure DevOps",
    "region": "Global",
    "category": "DevOps",
    "addressPrefixes": [
      "13.107.6.0/24",
      "13.107.9.0/24",
      "13.107.42.0/24",
      "13.107.43.0/24",
      "150.171.40.0/24"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  },
  {
    "name": "AzureBackup",
    "displayName": "Azure Backup",
    "region": "Global",
    "category": "Management",
    "addressPrefixes": [
      "13.66.140.128/26",
      "13.69.228.128/25",
      "20.150.36.0/22",
      "40.78.227.0/24"
    ],
    "networkFeatures": [
      "API",
      "NSG",
      "UDR",
      "FW"
    ]
  }
]

Key Takeaways

1Service tags represent groups of IP addresses for Azure services.
2Use service tags in NSG rules instead of hardcoding IP addresses.
3Service tags are automatically updated as Azure IP ranges change.
4Regional service tags limit traffic to specific Azure regions.
5Service tags work with NSGs, Azure Firewall, and UDRs.

Frequently Asked Questions

What are Azure service tags?

Service tags are named groups of IP address prefixes for Azure services like Storage, SQL, and AzureCloud. They simplify network security rules by abstracting away individual IP addresses that change frequently.

How often are service tag IP ranges updated?

Microsoft publishes updated service tag JSON files weekly. When used in NSG rules, service tags are automatically resolved to current IP ranges by the Azure platform without manual intervention.

Can I use service tags in on-premises firewalls?

Service tags are natively supported in NSGs and Azure Firewall. For on-premises firewalls, download the weekly JSON file from Microsoft and create rules based on the IP prefixes for the services you need.

What is the difference between regional and global service tags?

Global tags like 'Storage' include IP ranges across all regions. Regional tags like 'Storage.EastUS' include only the IP ranges for that specific region. Use regional tags to restrict traffic to the nearest Azure region.

Can I create custom service tags?

No, service tags are managed by Microsoft. However, you can create Application Security Groups (ASGs) to logically group your VMs and use them in NSG rules alongside service tags for flexible network policies.

Written by CloudToolStack Team

Cloud engineers and architects with hands-on experience across AWS, Azure, and GCP. We write guides based on real-world production patterns, not just documentation rewrites.

Disclaimer: This guide is for educational purposes. Cloud services change frequently; always refer to official documentation for the latest information. AWS, Azure, and GCP are trademarks of their respective owners.