(AzureCXP) fixes MicrosoftDocs/azure-docs#107784

Adds more information to the usage of "Virtual network service tags" and when updates on Firewall may be required.

Author: AnuragSingh-MSFT

articles/azure-monitor/agents/azure-monitor-agent-data-collection-endpoint.md

@@ -13,7 +13,9 @@ Azure Monitor Agent supports connecting by using direct proxies, Log Analytics g
 
 ## Virtual network service tags
 
-Azure Monitor Agent supports [Azure virtual network service tags](../../virtual-network/service-tags-overview.md). Both *AzureMonitor* and *AzureResourceManager* tags are required.
+Azure Monitor Agent supports [Azure virtual network service tags](../../virtual-network/service-tags-overview.md). Both *AzureMonitor* and *AzureResourceManager* tags are required. 
+
+Azure Virtual network service tags can be used to define network access controls on [network security groups](../../virtual-network/network-security-groups-overview.md#security-rules), [Azure Firewall](../../firewall/service-tags.md), and user-defined routes. Use service tags in place of specific IP addresses when you create security rules and routes. For scenarios where Azure virtual network service tags can not be used, the Firewall requirements are given below.
 
 ## Firewall requirements