# AzureServiceTags

- Kind: `class`
- Package: [Aspire.Hosting.Azure.Network](/reference/api/csharp/aspire.hosting.azure.network.md)
- Version: `13.4.0`
- Namespace: `Aspire.Hosting.Azure`
- Target framework: `net8.0`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/cbc352350f1a9bafbaff10d14a2c8de4ac186a48/src/Aspire.Hosting.Azure.Network/AzureServiceTags.cs)

Provides well-known Azure service tags that can be used as source or destination address prefixes in network security group rules.

## Definition

```csharp
namespace Aspire.Hosting.Azure;

public static class AzureServiceTags
{
    // ...
}
```

## Remarks

Service tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by each tag and automatically updates them as addresses change.

These tags can be used with the `from` and `to` parameters of methods such as [AzureVirtualNetworkExtensions.AllowInbound(IResourceBuilder<AzureSubnetResource>, string?, string?, string?, SecurityRuleProtocol?, int?, string?)](/reference/api/csharp/aspire.hosting.azure.network/azurevirtualnetworkextensions/methods.md#allowinbound-iresourcebuilder-azuresubnetresource-string-string-string-securityruleprotocol-int-string), [AzureVirtualNetworkExtensions.DenyInbound(IResourceBuilder<AzureSubnetResource>, string?, string?, string?, SecurityRuleProtocol?, int?, string?)](/reference/api/csharp/aspire.hosting.azure.network/azurevirtualnetworkextensions/methods.md#denyinbound-iresourcebuilder-azuresubnetresource-string-string-string-securityruleprotocol-int-string), [AzureVirtualNetworkExtensions.AllowOutbound(IResourceBuilder<AzureSubnetResource>, string?, string?, string?, SecurityRuleProtocol?, int?, string?)](/reference/api/csharp/aspire.hosting.azure.network/azurevirtualnetworkextensions/methods.md#allowoutbound-iresourcebuilder-azuresubnetresource-string-string-string-securityruleprotocol-int-string), [AzureVirtualNetworkExtensions.DenyOutbound(IResourceBuilder<AzureSubnetResource>, string?, string?, string?, SecurityRuleProtocol?, int?, string?)](/reference/api/csharp/aspire.hosting.azure.network/azurevirtualnetworkextensions/methods.md#denyoutbound-iresourcebuilder-azuresubnetresource-string-string-string-securityruleprotocol-int-string), or with the [AzureSecurityRule.SourceAddressPrefix](/reference/api/csharp/aspire.hosting.azure.network/azuresecurityrule/properties.md#sourceaddressprefix) and [AzureSecurityRule.DestinationAddressPrefix](/reference/api/csharp/aspire.hosting.azure.network/azuresecurityrule/properties.md#destinationaddressprefix) properties.

## Fields

- [AppService](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#appservice) : `string` `static` -- Represents Azure App Service and Azure Functions service addresses.
- [AzureActiveDirectory](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azureactivedirectory) : `string` `static` -- Represents Microsoft Entra ID (formerly Azure Active Directory) service addresses.
- [AzureContainerRegistry](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azurecontainerregistry) : `string` `static` -- Represents Azure Container Registry service addresses.
- [AzureCosmosDB](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azurecosmosdb) : `string` `static` -- Represents Azure Cosmos DB service addresses.
- [AzureKeyVault](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azurekeyvault) : `string` `static` -- Represents Azure Key Vault service addresses.
- [AzureLoadBalancer](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azureloadbalancer) : `string` `static` -- Represents the Azure infrastructure load balancer. This tag is commonly used to allow health probe traffic from Azure.
- [AzureMonitor](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azuremonitor) : `string` `static` -- Represents Azure Monitor service addresses, including Log Analytics, Application Insights, and Azure Monitor metrics.
- [AzureTrafficManager](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#azuretrafficmanager) : `string` `static` -- Represents Azure Traffic Manager probe IP addresses.
- [EventHub](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#eventhub) : `string` `static` -- Represents Azure Event Hubs service addresses.
- [GatewayManager](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#gatewaymanager) : `string` `static` -- Represents the Gateway Manager service, used for VPN Gateway and Application Gateway management traffic.
- [Internet](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#internet) : `string` `static` -- Represents the Internet address space, including all publicly routable IP addresses.
- [ServiceBus](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#servicebus) : `string` `static` -- Represents Azure Service Bus service addresses.
- [Sql](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#sql) : `string` `static` -- Represents Azure SQL Database, Azure Database for MySQL, Azure Database for PostgreSQL, Azure Database for MariaDB, and Azure Synapse Analytics.
- [Storage](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#storage) : `string` `static` -- Represents the Azure Storage service. This tag does not include specific Storage accounts; it covers all Azure Storage IP addresses.
- [VirtualNetwork](/reference/api/csharp/aspire.hosting.azure.network/azureservicetags/fields.md#virtualnetwork) : `string` `static` -- Represents the address space for the virtual network, including all connected address spaces, all connected on-premises address spaces, and peered virtual networks.

## Examples

Use service tags when configuring network security rules:

```csharp
var subnet = vnet.AddSubnet("web", "10.0.1.0/24")
    .AllowInbound(port: "443", from: AzureServiceTags.AzureLoadBalancer, protocol: SecurityRuleProtocol.Tcp)
    .DenyInbound(from: AzureServiceTags.Internet);
```