Cloud Shell Quick Tip: Service Tag Network Security Group Rule

Using the AzureCloud service tags mean you're allowing SSH access to your VM to all Azure datacenter public IPv4 addresses, including other subscriptions. This is an insecure solution.
https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags

I recommend instead creating an exception for the specific public IP address of your Azure cloud shell session. This example curl command returns the public IP address from a cloud shell bash session:
curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'