Azure Backup + on prem Network Security Group (NSG)
One issue I ran into when trying to setup our backups using Recover Services Vault was connection back to the service. If we have outbound security rules for our Network Security Group, we would have to white list all of the Azure IP addresses. This was a crazy long list that we would then have to maintain. The second option was to setup a proxy, which would cost money because that would be a second machine that would have to be running. I thought it might be nice if Azure created a tag for Azure services like the ones for Internet, VirtualNetwork and AzureLoadBalancer. Just thought that it would make it easier to allow the Network Security Group have access to Azure services without a lot of work.