<p>To use servicetags api you have to register Microsoft.Netowork resource provider at azure subscription level.</p>
<p><a href="https://i.sstatic.net/22yoe.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/22yoe.png" alt="In you subscription blade" /></a></p>
<p><a href="https://i.sstatic.net/gzKMz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/gzKMz.png" alt="Register Microsoft.Network" /></a></p>
<p>Instead you can use these api:</p>
<p>to get the ip address list of  a specified Azure Service in a specified Azure region:
<a href="https://azinfo.azurewebsites.net/api/servicetags/%7BregionName%7D/%7BserviceName%7D" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/servicetags/{regionName}/{serviceName}</a></p>
<p>to get valid region names
<a href="https://azinfo.azurewebsites.net/api/GetRegionNameList" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/GetRegionNameList</a></p>
<p>to get valid service names
<a href="https://azinfo.azurewebsites.net/api/GetServiceNameList" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/GetServiceNameList</a></p>
<p>to get the all the ip address list of all Azure Services in a specified Azure region
<a href="https://azinfo.azurewebsites.net/api/region/%7BregionName%7D" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/region/{regionName}</a></p>

CC BY-SA 4.0
2021-02-14T08:48:17.300Z
please add the example as part of the answer itself, rather than linking to a remote resource.
Bruce Becker
CC BY-SA 4.0
2021-02-12T12:44:21.053Z
2021-02-14T10:12:43.853Z
2021-02-14T10:12:43.853Z
Andrea
<p><strong>Goal</strong></p>
<p>I want to use the <a href="https://docs.microsoft.com/en-us/rest/api/virtualnetwork/servicetags/list" rel="nofollow noreferrer">service tags REST API endpoint</a> to get all the AzureCloud datacenter public IP addresses.</p>
<p>I am aware that I could manually download the generated <code>json</code> file from <a href="https://www.microsoft.com/en-us/download/details.aspx?id=56519" rel="nofollow noreferrer">Microsoft</a>.</p>
<p>My end goal is to use the endpoint to programmatically automate a task.</p>
<p><strong>Problem</strong></p>
<p>I can get a response with status code 200 of about 46k lines, but the AzureCloud tag is nowhere in the response body. It skips from AzureBotService to AzureCognitiveSearch. I believe AzureCloud should be between those two tags.</p>
<p><strong>Steps</strong></p>
<p>Firstly, I created an account using the AZ CLI tool with <code>az ad sp create-for-rbac -n &quot;MyApp&quot;</code>.</p>
<p>With a tenant ID, app ID/client ID, password/client secret, subscription ID. I can use <code>https://login.microsoftonline.com/{{ tenant_id }}/oauth2/token</code> to get a bearer token.</p>
<p>Using the bearer token, I can query the service tags using <code>https://management.azure.com/subscriptions/{{ subscription_id }}/providers/Microsoft.Network/locations/eastus/serviceTags?api-version=2020-05-01</code>.</p>
<p><strong>What I've done</strong></p>
<p>I came across a <a href="https://github.com/Azure/azure-cli/issues/12689" rel="nofollow noreferrer">GitHub issue</a> that is somewhat related to my problem stating that by design, we cannot get all the datacenter public IPs if the user does not have subscription level rights.</p>
<p>I tried the following commands to try to give subscription scope rights to my app, but to no avail:</p>
<ul>
<li><p><code>az ad sp create-for-rbac -n &quot;MyApp2&quot; --role reader --scopes &quot;/subscriptions/{{ subscription_id }}&quot;</code> to create a new account while specifying reader role and scope of the subscription. (I have retried the API with the new IDs as well).</p>
</li>
<li><p><code>az role assignment create --assignee &quot;{{ app_id }}&quot; --role &quot;Reader&quot; --scope &quot;/subscriptions/{{ subscription_id }}&quot;</code> to create a new role and specify scope.</p>
</li>
<li><p><code>az role assignment create --assignee &quot;{{ app_id }}&quot; --role &quot;Owner&quot; --subscription &quot;{{ subscription_id }}&quot;</code> to create a new role and specify subscription.</p>
</li>
</ul>
<p>My app still has the scope set to &quot;This resource&quot;.</p>
<p>I suspect there is something I am misunderstanding about Azure, given I am completely new to Azure (just created a free trial account yesterday).</p>
<p>All help will be appreciated, thank you!</p>

<azure>
Azure service tags REST API and subscription level rights
Gordon Pham-Nguyen
# Azure service tags REST API and subscription level rights

(Asked by: username_0 on 2020-11-21)

**Goal**

I want to use the [service tags REST API endpoint](https://docs.microsoft.com/en-us/rest/api/virtualnetwork/servicetags/list) to get all the AzureCloud datacenter public IP addresses.

I am aware that I could manually download the generated `json` file from [Microsoft](https://www.microsoft.com/en-us/download/details.aspx?id=56519).

My end goal is to use the endpoint to programmatically automate a task.

**Problem**

I can get a response with status code 200 of about 46k lines, but the AzureCloud tag is nowhere in the response body. It skips from AzureBotService to AzureCognitiveSearch. I believe AzureCloud should be between those two tags.

**Steps**

Firstly, I created an account using the AZ CLI tool with `az ad sp create-for-rbac -n "MyApp"`.

With a tenant ID, app ID/client ID, password/client secret, subscription ID. I can use `https://login.microsoftonline.com/{{ tenant_id }}/oauth2/token` to get a bearer token.

Using the bearer token, I can query the service tags using `https://management.azure.com/subscriptions/{{ subscription_id }}/providers/Microsoft.Network/locations/eastus/serviceTags?api-version=2020-05-01`.

**What I've done**

I came across a [GitHub issue](https://github.com/Azure/azure-cli/issues/12689) that is somewhat related to my problem stating that by design, we cannot get all the datacenter public IPs if the user does not have subscription level rights.

I tried the following commands to try to give subscription scope rights to my app, but to no avail:

* `az ad sp create-for-rbac -n "MyApp2" --role reader --scopes "/subscriptions/{{ subscription_id }}"` to create a new account while specifying reader role and scope of the subscription. (I have retried the API with the new IDs as well).
* `az role assignment create --assignee "{{ app_id }}" --role "Reader" --scope "/subscriptions/{{ subscription_id }}"` to create a new role and specify scope.
* `az role assignment create --assignee "{{ app_id }}" --role "Owner" --subscription "{{ subscription_id }}"` to create a new role and specify subscription.

My app still has the scope set to "This resource".

I suspect there is something I am misunderstanding about Azure, given I am completely new to Azure (just created a free trial account yesterday).

All help will be appreciated, thank you!

**Tags:** azure


---

## 1 answers

### Answer by username_1 on 2021-02-12. Score: 0

To use servicetags api you have to register Microsoft.Netowork resource provider at azure subscription level.

[![In you subscription blade](https://i.sstatic.net/22yoe.png)](https://i.sstatic.net/22yoe.png)

[![Register Microsoft.Network](https://i.sstatic.net/gzKMz.png)](https://i.sstatic.net/gzKMz.png)

Instead you can use these api:

to get the ip address list of a specified Azure Service in a specified Azure region:
[https://azinfo.azurewebsites.net/api/servicetags/{regionName}/{serviceName}](https://azinfo.azurewebsites.net/api/servicetags/%7BregionName%7D/%7BserviceName%7D)

to get valid region names
<https://azinfo.azurewebsites.net/api/GetRegionNameList>

to get valid service names
<https://azinfo.azurewebsites.net/api/GetServiceNameList>

to get the all the ip address list of all Azure Services in a specified Azure region
[https://azinfo.azurewebsites.net/api/region/{regionName}](https://azinfo.azurewebsites.net/api/region/%7BregionName%7D)

> **Comments:**
> **username_2**: please add the example as part of the answer itself, rather than linking to a remote resource.  

---

