scenarios for AzureKeyVault as servicetag in Inbound NSG Rule

I am new to Networking and have some questions regarding some of the service tags in Azure NSG.

If you see below, Azure has multiple options for service tags while defining inbound NSG rules. But I failed to understand the scenarios for AzureKeyVault, Storge, Cosmos DB etc. in which scenarios these services initiate the request? Why do we need these service tags in the inbound NSG.

But I failed to understand the scenarios for AzureKeyVault, Storage, Cosmos DB etc. in which scenarios these services initiate the request? Why do we need these service tags in the inbound NSG.

It's not so good understanding for service tags in the inbound NSG as outbound NSG. For example, If you want to deny all outbound internet traffic and allow only traffic to specific Azure services such as AzurekeyVault or AzureCosmosDB. You can do so using service tags as the destination in your NSG outbound rules.

Similarly, If you want to allow or deny traffic from Azure service in a virtual network, Ip address or Application security group. You can do so using service tags as the source in your NSG inbound rules. For example, you can set the service tag AppService and specific IP addresses(some specific VM IP address) as the destination, then you could restrict the AppService to access the resources in your VM like API or database.

For more details, you can view scenarios for securing your Azure service.