Azure Service Tags

Hi Peter Stieber ,

Yes, this is by design.

The Microsoft.Network/serviceTags REST API returns the Azure Virtual Network service tags dataset (the same data published in the weekly Service Tags JSON download). These tags represent Azure service IP prefixes that are exposed through the Azure Service Tags platform and are documented in the Azure Service Tags overview.

The Office 365 / Microsoft 365 tags you listed (Office365.Exchange.Optimize, Office365.Skype.Allow.Required, Office365.SharePoint.Optimize, etc.) are a special set of Azure Firewall built-in Microsoft 365 service tags, not standard Azure Service Tags returned by the Service Tags API. Azure Firewall documentation explicitly states that Azure Firewall supports:

• Regular Azure service tags from the Virtual Network Service Tags catalog.
• Additional tags for Microsoft 365 endpoints, categorized by product (Exchange, Skype, SharePoint, Common) and category (Optimize, Allow, etc.).

Because these Microsoft 365 tags are Azure Firewall–specific constructs, they are not exposed through the serviceTags endpoint, which explains why they don't appear in the API response.

How to retrieve the corresponding IP ranges

For Microsoft 365 endpoints, Microsoft recommends using the Microsoft 365 endpoints data source rather than the Azure Service Tags API. Azure Firewall automatically maintains the underlying Microsoft 365 IP addresses and FQDNs for its built-in tags.

For programmatic access to the underlying endpoint data, use the Microsoft 365 endpoint web service:

• Microsoft 365 endpoints overview: https://learn.microsoft.com/microsoft-365/enterprise/urls-and-ip-address-ranges
• Endpoint web service: https://learn.microsoft.com/microsoft-365/enterprise/microsoft-365-ip-web-service

These services provide the authoritative Microsoft 365 endpoint information, including IP ranges and FQDNs that Azure Firewall uses to build and maintain its Microsoft 365 service tags.

Hi @Peter Stieber ,

here you can find all current available Azure Service Tags: Available service tags

Unfortunately there are no dedicated Office 365 tags listed.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten