Answers: <p>To use servicetags api you have to register Microsoft.Netowork resource provider at azure subscription level.</p>
  <p><a href="https://i.sstatic.net/22yoe.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/22yoe.png" alt="In you subscription blade" /></a></p>
  <p><a href="https://i.sstatic.net/gzKMz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/gzKMz.png" alt="Register Microsoft.Network" /></a></p>
  <p>Instead you can use these api:</p>
  <p>to get the ip address list of  a specified Azure Service in a specified Azure region:
  <a href="https://azinfo.azurewebsites.net/api/servicetags/%7BregionName%7D/%7BserviceName%7D" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/servicetags/{regionName}/{serviceName}</a></p>
  <p>to get valid region names
  <a href="https://azinfo.azurewebsites.net/api/GetRegionNameList" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/GetRegionNameList</a></p>
  <p>to get valid service names
  <a href="https://azinfo.azurewebsites.net/api/GetServiceNameList" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/GetServiceNameList</a></p>
  <p>to get the all the ip address list of all Azure Services in a specified Azure region
  <a href="https://azinfo.azurewebsites.net/api/region/%7BregionName%7D" rel="nofollow noreferrer">https://azinfo.azurewebsites.net/api/region/{regionName}</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-02-14T08:48:17.300Z
Answers: please add the example as part of the answer itself, rather than linking to a remote resource.
Answers: Bruce Becker
Answers: CC BY-SA 4.0
Answers: 2021-02-12T12:44:21.053Z
Answers: 2021-02-14T10:12:43.853Z
Answers: 2021-02-14T10:12:43.853Z
Answers: Andrea
Body: <p><strong>Goal</strong></p>
  <p>I want to use the <a href="https://docs.microsoft.com/en-us/rest/api/virtualnetwork/servicetags/list" rel="nofollow noreferrer">service tags REST API endpoint</a> to get all the AzureCloud datacenter public IP addresses.</p>
  <p>I am aware that I could manually download the generated <code>json</code> file from <a href="https://www.microsoft.com/en-us/download/details.aspx?id=56519" rel="nofollow noreferrer">Microsoft</a>.</p>
  <p>My end goal is to use the endpoint to programmatically automate a task.</p>
  <p><strong>Problem</strong></p>
  <p>I can get a response with status code 200 of about 46k lines, but the AzureCloud tag is nowhere in the response body. It skips from AzureBotService to AzureCognitiveSearch. I believe AzureCloud should be between those two tags.</p>
  <p><strong>Steps</strong></p>
  <p>Firstly, I created an account using the AZ CLI tool with <code>az ad sp create-for-rbac -n &quot;MyApp&quot;</code>.</p>
  <p>With a tenant ID, app ID/client ID, password/client secret, subscription ID. I can use <code>https://login.microsoftonline.com/{{ tenant_id }}/oauth2/token</code> to get a bearer token.</p>
  <p>Using the bearer token, I can query the service tags using <code>https://management.azure.com/subscriptions/{{ subscription_id }}/providers/Microsoft.Network/locations/eastus/serviceTags?api-version=2020-05-01</code>.</p>
  <p><strong>What I've done</strong></p>
  <p>I came across a <a href="https://github.com/Azure/azure-cli/issues/12689" rel="nofollow noreferrer">GitHub issue</a> that is somewhat related to my problem stating that by design, we cannot get all the datacenter public IPs if the user does not have subscription level rights.</p>
  <p>I tried the following commands to try to give subscription scope rights to my app, but to no avail:</p>
  <ul>
  <li><p><code>az ad sp create-for-rbac -n &quot;MyApp2&quot; --role reader --scopes &quot;/subscriptions/{{ subscription_id }}&quot;</code> to create a new account while specifying reader role and scope of the subscription. (I have retried the API with the new IDs as well).</p>
  </li>
  <li><p><code>az role assignment create --assignee &quot;{{ app_id }}&quot; --role &quot;Reader&quot; --scope &quot;/subscriptions/{{ subscription_id }}&quot;</code> to create a new role and specify scope.</p>
  </li>
  <li><p><code>az role assignment create --assignee &quot;{{ app_id }}&quot; --role &quot;Owner&quot; --subscription &quot;{{ subscription_id }}&quot;</code> to create a new role and specify subscription.</p>
  </li>
  </ul>
  <p>My app still has the scope set to &quot;This resource&quot;.</p>
  <p>I suspect there is something I am misunderstanding about Azure, given I am completely new to Azure (just created a free trial account yesterday).</p>
  <p>All help will be appreciated, thank you!</p>
  
Tags: <azure>
Title: Azure service tags REST API and subscription level rights
UserDisplayName: Gordon Pham-Nguyen
ThreadText: # Azure service tags REST API and subscription level rights
  
  (Asked by: username_0 on 2020-11-21)
  
  **Goal**
  
  I want to use the [service tags REST API endpoint](https://docs.microsoft.com/en-us/rest/api/virtualnetwork/servicetags/list) to get all the AzureCloud datacenter public IP addresses.
  
  I am aware that I could manually download the generated `json` file from [Microsoft](https://www.microsoft.com/en-us/download/details.aspx?id=56519).
  
  My end goal is to use the endpoint to programmatically automate a task.
  
  **Problem**
  
  I can get a response with status code 200 of about 46k lines, but the AzureCloud tag is nowhere in the response body. It skips from AzureBotService to AzureCognitiveSearch. I believe AzureCloud should be between those two tags.
  
  **Steps**
  
  Firstly, I created an account using the AZ CLI tool with `az ad sp create-for-rbac -n "MyApp"`.
  
  With a tenant ID, app ID/client ID, password/client secret, subscription ID. I can use `https://login.microsoftonline.com/{{ tenant_id }}/oauth2/token` to get a bearer token.
  
  Using the bearer token, I can query the service tags using `https://management.azure.com/subscriptions/{{ subscription_id }}/providers/Microsoft.Network/locations/eastus/serviceTags?api-version=2020-05-01`.
  
  **What I've done**
  
  I came across a [GitHub issue](https://github.com/Azure/azure-cli/issues/12689) that is somewhat related to my problem stating that by design, we cannot get all the datacenter public IPs if the user does not have subscription level rights.
  
  I tried the following commands to try to give subscription scope rights to my app, but to no avail:
  
  * `az ad sp create-for-rbac -n "MyApp2" --role reader --scopes "/subscriptions/{{ subscription_id }}"` to create a new account while specifying reader role and scope of the subscription. (I have retried the API with the new IDs as well).
  * `az role assignment create --assignee "{{ app_id }}" --role "Reader" --scope "/subscriptions/{{ subscription_id }}"` to create a new role and specify scope.
  * `az role assignment create --assignee "{{ app_id }}" --role "Owner" --subscription "{{ subscription_id }}"` to create a new role and specify subscription.
  
  My app still has the scope set to "This resource".
  
  I suspect there is something I am misunderstanding about Azure, given I am completely new to Azure (just created a free trial account yesterday).
  
  All help will be appreciated, thank you!
  
  **Tags:** azure
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-02-12. Score: 0
  
  To use servicetags api you have to register Microsoft.Netowork resource provider at azure subscription level.
  
  [![In you subscription blade](https://i.sstatic.net/22yoe.png)](https://i.sstatic.net/22yoe.png)
  
  [![Register Microsoft.Network](https://i.sstatic.net/gzKMz.png)](https://i.sstatic.net/gzKMz.png)
  
  Instead you can use these api:
  
  to get the ip address list of a specified Azure Service in a specified Azure region:
  [https://azinfo.azurewebsites.net/api/servicetags/{regionName}/{serviceName}](https://azinfo.azurewebsites.net/api/servicetags/%7BregionName%7D/%7BserviceName%7D)
  
  to get valid region names
  <https://azinfo.azurewebsites.net/api/GetRegionNameList>
  
  to get valid service names
  <https://azinfo.azurewebsites.net/api/GetServiceNameList>
  
  to get the all the ip address list of all Azure Services in a specified Azure region
  [https://azinfo.azurewebsites.net/api/region/{regionName}](https://azinfo.azurewebsites.net/api/region/%7BregionName%7D)
  
  > **Comments:**
  > **username_2**: please add the example as part of the answer itself, rather than linking to a remote resource.  
  
  ---
  
  