Azure Network Secuirty Group: Unable to find service tag 'ApiManagement' in inbound and outbound rules

Nishant Sharma 21

I need to add inbound and outbound security rules to an NSG for my API Management instance, the documentation states that there are few rules to create and those rules should use the service tag "ApiManagement" for source in inbound rules for example. Unfortunately, on my side, the service tag "ApiManagement" is not available in the list of service tags, I only have Internet, Virtual Network and AzureLoadBalancer... Do I need to do something special to have those tags available? Maybe, I missed several permissions on the Subscription/Resource group?

DHPH 5 Reputation points

2023-10-27T14:06:31.7233333+00:00

@SaiKishor-MSFT I also have the same issue, while configuring nsg for api management service, the service tag of api-management doesn't exists. Eventhough I tried to use public ip of api-mgmt, the network connectivity check still failed. The platform of api-mgmt is stv2.1. I am configuring vnet external for api-mgmt. I dont think my api-mgmt service was deployed using classic model.

4 answers

SaiKishor-MSFT 17,326 Reputation points

2022-01-25T03:05:18.46+00:00

@Nishant Sharma Thank you for reaching out to Microsoft Q&A. The Service Tag 'ApiManagement' will be available only in the inbound direction. Please take a look at this table for more details regarding Service Tags. Are you looking at the inbound Security Group rules but cannot find the "ApiManagement" Tag? If so, please share your subscription/region and NSG details so I can further investigate. Thank you!

Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.
Please sign in to rate this answer.
Nishant Sharma 21 Reputation points

2022-01-25T07:28:39.98+00:00

Hi @SaiKishor-MSFT
Here are the details you required regarding this issue:

My Region is West US 2.

Steps used to create NSG:

Created a NSG using Network security groups service:

Default Inbound security rules

Adding inbound security rule:

As shown in the above image, while adding inbound security rule after selecting Service Tag in Source, ApiManagement service tag is not available (only Internet, VirtualNetwork and AzureLoadBalancer). So what is reason behind it. Am I creating the Network Security Group in a wrong way or if there is another way of creating it other than portal so that other service tags (ApiManagement) will be available?

I also followed the link you shared - https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags
I found something regarding the classic deployment model shown in the image below:

Is this the reason for not showing the other service tags (ApiManagement)? If so, then what is the procedure to choose other deployment model so that the service tags get available.

Kinvi Ekoue-bla 0 Reputation points

2023-10-26T20:34:57.4633333+00:00

I would like to know whether this issue is resolved as I'm facing the same challenge.

Thanks

Kinvi
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
SaiKishor-MSFT 17,326 Reputation points

2022-01-26T00:53:39.427+00:00

@Nishant Sharma If you find the VMs of type virtual machines (classic) on the Azure portal's VM pane, then it is a classic VM and which is why all the tags are not showing. Since VMs created using the classic deployment model will follow the Modern Lifecycle Policy for retirement, it is advisable that you migrate to the Resource Model Deployment model.

Here are steps to migrate to the VM from the Classic deployment model to the Resource Manager Deployment model. If you instead plan to create a new VM in the Resource Model Deployment model, then you must first create a Virtual Network also in the the Resource Manager Deployment model. You can follow this Powershell script to configure a VM in the Resource Manager Model or you can use the Portal to do the same here. Hope this helps.

Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.
Please sign in to rate this answer.
Nishant Sharma 21 Reputation points

2022-01-27T06:55:45.287+00:00

@SaiKishor-MSFT
Firstly, thank you for replying in such short period of time. But unfortunately the above use case seems to be for VM.
We are directly deploying on the resource group using the portal and we are not using any VM for that.
Applying NSG with inbound security rule having service tag ApiManagement using Azure portal would solve the problem I am facing as described in the asked question.
Using ARM I am able to add the ApiManagement and other service tags, but using portal these service tags are not avaiblable by default.
So is there any way to add the same ApiManagement service tag using Azure portal rather than ARM or PowerShell script?

SaiKishor-MSFT 17,326 Reputation points

2022-02-01T23:38:17.337+00:00

@Nishant Sharma Are you selecting the NSG type classic? Seee below-

Nishant Sharma 21 Reputation points

2022-02-05T10:15:25.473+00:00

@SaiKishor-MSFT
No, I am not selecting the NSG type classic. See the image below
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
kkc 6 Reputation points Microsoft Employee

2023-01-11T18:49:11.8566667+00:00

What's the solution to this problem? I am having the same issue. @SaiKishor-MSFT
Please sign in to rate this answer.
Pak-Hun Chan 20 Reputation points

2023-03-28T18:02:20.71+00:00

This reply is probably too late to be useful, but I ran into the same problem just now and resolved it by using Azure CLI instead. It turns out that the Azure Portal doesn't show all of the source/destination service tags (eg, ApiManagement).

The solution is to create these NSG inbound/outbound rules using Azure CLI, PowerShell, or ARM templates. Here's the CLI command that I used:

az network nsg rule create \ --name InboundRuleAllow3443ApimanagementToVirtualnetwork \ --nsg-name my-nsg \ --priority 1000 \ --resource-group my-resource-group \ --access Allow \ --source-address-prefixes ApiManagement \ --destination-address-prefixes VirtualNetwork \ --destination-port-ranges 3443 \ --direction Inbound \ --protocol Tcp

DIEGO RICARDO POREZ RAMIREZ 1 Reputation point

2024-05-21T16:45:03.9+00:00

What's the solution to this problem? I am having the same issue too

David Pratt 0 Reputation points

2024-06-21T18:44:14.9066667+00:00

Thanks Chan! It does work via the CLI, but that's really unprofessional. It's been a couple months now and its still not fixed in the UI. Hard to believe it even works since the edit pane shows blank. MS, you gonna address this anytime soon?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Dmello, Lygel 0 Reputation points

2025-02-13T09:36:24.04+00:00

You need Network Contributor Role at the Subscription level to be able to see the service tag in the NSG dropdown
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Network Secuirty Group: Unable to find service tag 'ApiManagement' in inbound and outbound rules

4 answers

Your answer