The problem is that Azure included all Azure services under the service tag of \u201cInternet\u201d. And Azure VMs need to talk to Azure to boot up \u2013 to be specific, they need to talk to Azure Storage if the IaaSDiagnostics (Azure Performance Diagnostics) extension is configured. If a VM can\u2019t talk to that storage account, the VM will fail to boot. There was a scripted workaround<\/a>, but it was far<\/em> from pretty.<\/p>\n Recently Microsoft made a Network Security Group service tags<\/a> generally available. Service tags take those old locations and expand them to more than just Virtual Network, Load Balancer (probe), and Internet. Now you can specify Azure storage (storage account) and Azure SQL services, globally and locally (a specific region).<\/p>\n So for example, I can let a VM connect (Azure) Storage globally, in West Europe, or to connect to Azure SQL in North Europe. Now we can block outbound access to the Internet, but still allow access to Azure storage in the same region for diagnostics & metrics.<\/p>\n I\u2019ve tested, and yes, my VM rebooted If you found this information useful, then imagine what 2 days of training might mean to you. I’m delivering a 2-day course in Amsterdam on April 19-20, teaching newbies and experienced Azure admins about Azure Infrastructure. There’ll be lots of in-depth information, covering the foundations, best practices, troubleshooting, and advanced configurations. You can learn more here<\/a>.<\/p>\n In theory, it was possible to deny all outbound traffic to the Internet from an Azure VM. In theory, I can also place a loaded gun to my head, but my doctor disapproves of that. Here\u2019s what would happen: You created an outbound rule to Deny all traffic to a service tag (location) called Internet. … Continue reading “Azure VMs–Block Outbound Traffic to the Internet (Updated)”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":19553,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[170,242,243,80,190,244],"class_list":["post-20896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-firewall","tag-network-security-groups","tag-networking","tag-security","tag-service-tags"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2018\/01\/image_thumb.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2018\/01\/image_thumb-1.png\" "\\"image\\"")
<\/a><\/p>\n![\"Smile\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2018\/01\/wlEmoticon-smile.png\")
<\/p>\nWas This Post Useful?<\/h2>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2018\/01\/AMS-Apr-2018-Cloud-Mechanix.png\")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"