Generally Available: Service tag match condition for Azure Front Door Premium WAF

Announcing the general availability of the service tag match condition for Azure Web Application Firewall (WAF) custom rules on Azure Front Door Premium.

Service tags represent groups of IP address prefixes used by Azure services, and Microsoft updates them automatically as addresses change. Custom rules can now match a HTTP request's source IP address against service tags, so you can control traffic from Azure services without building and maintaining lists of IPs.

With service tag matching, you can:

- Allow Azure services your application relies on, such as monitoring and health checks, through to your endpoints.

- Block traffic from Azure services your application never expects to receive requests from.

- Restrict sensitive paths, such as admin endpoints, by combining a service tag with URI, host, or request method conditions.

- Rate limit traffic from an Azure service instead of blocking it outright.

Learn more.