Search code examples
azureazure-devopsazure-keyvaultnetwork-security-groups

Azure DevOps Service tags are not available in Network Security Group

I am trying to connect Azure DevOps with Azure KeyVault by whitelisting the IP addresses of Azure DevOps into the key vault. Now I need to add the service tag of Azure DevOps into KeyVault. I am following the below process to do it. Please correct me if I am wrong?

  • Create a Network Security Group
  • Click on Inbound security rules
  • Click on Add button to add a rule
  • Select Source as “Service Tag”
  • Select the Souce service tag as “AzureDevOps” (unfortunately this tag is not available).

enter image description here

Please let me know how can I add the Service Tag of Azure DevOps in the Network security group and map the Network Security Group with Azure Key Vault?

Solution

  • As of today they are available on the Portal (18-11-2021)

    enter image description here

    Original reply

    You can't. Azure Devops Service Tag is not available from the Portal

    enter image description here

    Info taken from documentation.

    Now that a service tag has been set up for Azure DevOps Services, customers can easily allow access by adding the tag name AzureDevOps to their NSGs or firewalls programmatically using Powershell and CLI.

    Here os the info on the blog.

    And what is important here is:

    The Service Tag does not apply to Microsoft Hosted Agents. Customers are still required to allow the entire geography for the Microsoft Hosted Agents. If allowing the entire geography is a concern, we recommend using the Azure Virtual Machine Scale Set Agents. The Scale Set Agents are a form of self-hosted agents that can be autoscaled to meet your demands.