Use service tags for Azure SignalR Service
You can use Service Tags to identify Azure SignalR Service traffic. A service tag represents a group of IP address prefixes. Azure SignalR Service manages a service tag called AzureSignalR for both inbound and outbound traffic.
A service tag can be used when for configuring Network Security Group. Alternatively, you can query the IP address prefixes using Service Tag Discovery API.
Outbound traffic
Endpoints of Azure SignalR Service resources are guaranteed to be within IP ranges of Service Tag AzureSignalR.
Access Azure SignalR Service from virtual network
You can allow outbound traffic from your network to Azure SignalR Service by adding a new outbound network security rule.
On portal, go to the network security group.
Select on the settings menu called Outbound security rules.
Select the Add button.
Select Destination and choose Service Tag.
Select Destination service tag and choose AzureSignalR.
Enter 443 in Destination port ranges.
Adjust other fields as needed.
Select Add.
Inbound traffic
In following scenarios, Azure SignalR Service can generate network traffic to your resource. The source of traffic is guaranteed to be within IP ranges of Service Tag AzureSignalR.
- Use upstream endpoints in serverless mode.
- Use Key Vault secret reference in URL template settings.
- Use custom certificate.
Upstream endpoints in virtual network
You can configure Network Security Group to allow inbound traffic to virtual network:
On portal, go to the network security group.
Select Inbound security rules.
Select the Add button.
Select Source and choose Service Tag from the list.
Select Source service tag and choose AzureSignalR from the list.
Enter * in Source port ranges.
Change other settings as needed.
Select Add.
Note
Azure SignalR Service is a shared service. By allowing Service Tag AzureSignalR or its associated IP address prefixes, you also allow traffic from other resources, even if they belong to other customers. Make sure you implement appropriate authentication on your endpoints.
Upstream endpoints of Azure Function
You can configure a service tag-based rule.
Alternatively, you can use Shared Private Endpoints for better security. Shared Private Endpoints are dedicated to your resources. No traffic from other resources can access your endpoints.
Key vault access
We recommend Shared Private Endpoints for best security.