Update service tag doc

Author: ArchangelSDY

articles/azure-signalr/howto-service-tags.md

@@ -12,37 +12,19 @@ ms.author: lianwei
 
 # Use service tags for Azure SignalR Service
 
-You can use [Service Tags](../virtual-network/service-tags-overview.md) with Azure SignalR Service when configuring [Network Security Group](../virtual-network/network-security-groups-overview.md#network-security-groups). Service tags allow you to define inbound/outbound network security rules for Azure resources that connect to the SignalR Service endpoints without the need to hardcode IP addresses.  
+You can use [Service Tags](../virtual-network/service-tags-overview.md) to identify Azure SignalR Service traffic. A service tag represents a group of IP address prefixes. Azure SignalR Service manages a service tag called `AzureSignalR` for both inbound and outbound traffic.
 
-The SignalR Service manages service tags, which means that you can't create your own service tag or modify an existing one. Microsoft manages address prefixes that match the service tag and automatically updates the service tag as addresses change.
+A service tag can be used when for configuring **Network Security Group**. Alternatively, you can query the IP address prefixes using [Service Tag Discovery API](../virtual-network/service-tags-overview.md#service-tags-on-premises).
 
-This article shows you how to create a network security group with inbound/outbound service tags for Azure SignalR Service.  Once you've created the network security group, you can apply it to the resource, such as Azure Functions, connecting to SignalR Service.
+## Outbound traffic
 
-> [!Note]
-> Starting 15 August 2021, Azure SignalR Service supports bidirectional service tags for both inbound and outbound traffic.
-
-## Create a network security group 
-
-Create a network security group using the Azure portal:
-
-1. Search for **Network security groups** in the Azure portal.
-1. Select **Network security groups**.
-1. Select **Create**
-1. Enter the settings for the network security group:
-    | Field| Value|
-    | Subscription | Your subscription |
-    | Resource group | Choose an existing or create a new resource group |
-    | Name | Your network security group name |
-    | Region | Your region |
-1. Select **Review + create**.
-1. Select **Create**.
+Endpoints of Azure SignalR Service resources are guaranteed to be within IP ranges of Service Tag `AzureSignalR`.
 
+### Access Azure SignalR Service from virtual network
 
-### Configure outbound traffic
+You can allow outbound traffic from your network to Azure SignalR Service by adding a new outbound network security rule.
 
-You can allow outbound traffic to Azure SignalR Service by adding a new outbound network security rule.
-
-1. Select **Go to resource** or go to the network security group.
+1. On portal, go to the network security group.
 1. Select on the settings menu called **Outbound security rules**.
 1. Select the **Add** button.
 1. Select **Destination** and choose **Service Tag**.
@@ -54,11 +36,19 @@ You can allow outbound traffic to Azure SignalR Service by adding a new outbound
 1. Adjust other fields as needed.
 1. Select **Add**.
 
-### Configure inbound traffic
+## Inbound traffic
+
+In following scenarios, Azure SignalR Service can generate network traffic to your resource. The source of traffic is guaranteed to be within IP ranges of Service Tag `AzureSignalR`.
+
+* Use [upstream endpoints](concept-upstream.md) in [serverless mode](signalr-concept-azure-functions.md).
+* Use [Key Vault secret reference](concept-upstream.md#key-vault-secret-reference-in-url-template-settings) in URL template settings.
+* Use [custom certificate](howto-custom-domain.md#add-a-custom-certificate).
+
+### Upstream endpoints in virtual network
 
-If you're using upstream endpoints, you can also enable inbound traffic from Azure SignalR Service by adding a new inbound network security rule:
+You can configure **Network Security Group** to allow inbound traffic to virtual network:
 
-1. Go to the network security group.
+1. On portal, go to the network security group.
 1. Select  **Inbound security rules**.
 1. Select the **Add** button.
 1. Select **Source** and choose **Service Tag** from the list.
@@ -70,6 +60,19 @@ If you're using upstream endpoints, you can also enable inbound traffic from Azu
 1. Change other settings as needed.
 1. Select **Add**.
 
+> [!Note]
+> Azure SignalR Service is a shared service. By allowing Service Tag `AzureSignalR` or its associated IP address prefixes, you also allow traffic from other resources, even if they belong to other customers. Make sure you implement appropriate authentication on your endpoints.
+
+### Upstream endpoints of Azure Function
+
+You can configure a [service tag-based rule](../app-service/app-service-ip-restrictions.md#set-a-service-tag-based-rule).
+
+Alternatively, you can use [Shared Private Endpoints](howto-shared-private-endpoints.md) for better security. Shared Private Endpoints are dedicated to your resources. No traffic from other resources can access your endpoints.
+
+### Key vault access
+
+We recommend [Shared Private Endpoints](howto-shared-private-endpoints-key-vault.md) for best security.
+
 ## Next steps
 
 - [Network security groups: service tags](../virtual-network/network-security-groups-overview.md#security-rules)