I am looking to only allow traffic to one NSG from several specific VNets. Per the serviceTag documentation I should be able to allow it from a specific VNet but the UI does not seem to support this.