does azure cosmosdb service tag include physical partition ip ranges?

Question

I added a NSG rules to block the outbound requests to cosmosdb but found out that only the requests to cosmosdb gateway has been blocked. The requests to physical pation still could go through. So does azure cosmosdb service tag include physical partition ip ranges?

Answer 1

Hi @Zengbo Luo,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

As i understand that you are trying to block the outbound requests to Cosmos DB using Network Security Group(NSG) rule.

I would like to inform you that, The Azure Cosmos DB service tag only covers gateway traffic and do not include physical partition IP ranges. When you added a Network Security Group (NSG) rule to block outbound traffic to Cosmos DB using the service tag, you effectively blocked traffic to the gateway layer.

Please refer to this link https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.