Azure service tags REST API and subscription level rights

Question

Goal

I want to use the service tags REST API endpoint to get all the AzureCloud datacenter public IP addresses.

I am aware that I could manually download the generated json file from Microsoft.

My end goal is to use the endpoint to programmatically automate a task.

Problem

I can get a response with status code 200 of about 46k lines, but the AzureCloud tag is nowhere in the response body. It skips from AzureBotService to AzureCognitiveSearch. I believe AzureCloud should be between those two tags.

Steps

Firstly, I created an account using the AZ CLI tool with az ad sp create-for-rbac -n "MyApp".

With a tenant ID, app ID/client ID, password/client secret, subscription ID. I can use https://login.microsoftonline.com/{{ tenant_id }}/oauth2/token to get a bearer token.

Using the bearer token, I can query the service tags using https://management.azure.com/subscriptions/{{ subscription_id }}/providers/Microsoft.Network/locations/eastus/serviceTags?api-version=2020-05-01.

What I've done

I came across a GitHub issue that is somewhat related to my problem stating that by design, we cannot get all the datacenter public IPs if the user does not have subscription level rights.

I tried the following commands to try to give subscription scope rights to my app, but to no avail:

• az ad sp create-for-rbac -n "MyApp2" --role reader --scopes "/subscriptions/{{ subscription_id }}" to create a new account while specifying reader role and scope of the subscription. (I have retried the API with the new IDs as well).

• az role assignment create --assignee "{{ app_id }}" --role "Reader" --scope "/subscriptions/{{ subscription_id }}" to create a new role and specify scope.

• az role assignment create --assignee "{{ app_id }}" --role "Owner" --subscription "{{ subscription_id }}" to create a new role and specify subscription.

My app still has the scope set to "This resource".

I suspect there is something I am misunderstanding about Azure, given I am completely new to Azure (just created a free trial account yesterday).

All help will be appreciated, thank you!

Answer 1

To use servicetags api you have to register Microsoft.Netowork resource provider at azure subscription level.

Instead you can use these api:

to get the ip address list of a specified Azure Service in a specified Azure region: https://azinfo.azurewebsites.net/api/servicetags/{regionName}/{serviceName}

to get valid region names https://azinfo.azurewebsites.net/api/GetRegionNameList

to get valid service names https://azinfo.azurewebsites.net/api/GetServiceNameList

to get the all the ip address list of all Azure Services in a specified Azure region https://azinfo.azurewebsites.net/api/region/{regionName}