A service tag is a Microsoft-managed name for a group of Azure service IP address ranges. It lets you refer to services without hardcoding addresses that may change. section 4.3
Use a service tag as the source or destination in a network security group rule. That keeps access rules readable while Microsoft maintains the underlying ranges. section 4.3
Allowing Azure Load Balancer traffic
A default inbound NSG rule can use Azure Load Balancer as its source and allow traffic to any destination. The tag represents the service group rather than a manually maintained IP list. section 4.3
Table 4.3 Inbound security rules for a default NSG
| Priority |
Name |
Port |
Protocol |
Source |
Destination |
Action |
| 300 |
|
22 |
TCP |
Any |
Any |
Allow |
| 65000 |
|
Any |
Any |
VNet |
VNet |
Allow |
| 65001 |
|
Any |
Any |
Azure Load Balancer |
Any |
Allow |
| 65002 |
|
Any |
Any |
Any |
Any |
Deny |
Inspect the default NSG rule table to see a service tag used in a real source field alongside priority, protocol, and action. section 4.3

