Azure Firewall Complete Guide: Basic/Standard/Premium Selection, Rule Design, and Firewall Manager

Azure Firewall is a Microsoft-managed stateful L3-L7 firewall and network security service. Deployed per VNet, it delivers organization-wide traffic control, FQDN filtering, threat intelligence integration, IDPS (Premium), and TLS inspection (Premium). The standard pattern is to place it in the Hub VNet of a hub-and-spoke architecture. It plays a complementary role to Network Security Groups (NSGs): NSGs handle subnet-level L3-L4 controls while Azure Firewall provides L7 governance across the entire VNet.

Basic SKU (GA 2023): targeted at SMBs, up to 250 Mbps, starting around $300/month. Includes Application/Network Rules, basic threat intelligence, and IP Groups. Standard SKU: for typical enterprises, up to 30 Gbps, starting around $900/month. Supports Forced Tunneling, DNS Proxy, and Zone Redundancy. Premium SKU: for advanced security requirements, starting around $2,600/month. Adds TLS inspection (encrypted traffic inspection), IDPS (intrusion detection and prevention), URL filtering, and Web Categories. Use Premium when you need malware inspection inside encrypted traffic or advanced compliance such as PCI DSS or HIPAA. Most production environments are well served by Standard.

Azure Firewall Manager is a control-plane service for centrally managing multiple Azure Firewall instances. You create JSON-based Firewall Policies and apply them across firewalls with inheritance support. Integrating Azure Firewall into a Secured Virtual Hub in Virtual WAN requires going through Firewall Manager. In enterprises operating multi-region hub-and-spoke deployments, the best practice is to define common policies (allow Microsoft 365, block risky countries, etc.) as a parent policy inherited by every firewall, then layer region-specific rules in child policies. You can also delegate Firewall Policy ownership to your SOC team via Microsoft Entra ID RBAC.

Network Rules provide L3-L4 control based on IP addresses, ports, and protocols (TCP/UDP/ICMP) — the classic firewall rule. Application Rules provide L7 control based on FQDNs (Fully Qualified Domain Names), and apply only to HTTP/HTTPS. For example, "allow HTTPS to *.microsoft.com" or "allow HTTP/HTTPS to *.windowsupdate.com". Microsoft also ships FQDN Tags — pre-defined FQDN groups such as Microsoft365, WindowsUpdate, and AzureBackup. The design principle: outbound access to Microsoft 365, Windows Update, and Azure services should be configured concisely with Application Rules + FQDN Tags, while server-to-server traffic should be controlled by Network Rules using IP and port.

DNAT Rules forward traffic that reaches the Azure Firewall's public IP to a private IP inside the VNet. Typical use cases: 1) RDP/SSH management access (e.g., forward port 22 on the firewall's public IP to port 22 on a Jumpbox VM inside the VNet); 2) Web server publishing (forward 80/443 on the firewall to a Web Server VM); 3) Receiving specific ports from IoT devices. Caveat: pay special attention to the security of any VM exposed via a DNAT Rule — going through Application Gateway WAF or Front Door is more secure. For production web publishing, the recommended combination is Application Gateway / Front Door + WAF + Private Endpoint. Azure Firewall DNAT is best reserved for management scenarios.

Forced Tunneling is a configuration that routes internet-bound traffic from Azure Firewall or an Azure VNet out through an on-premises firewall. It's the pattern used by financial institutions and government agencies whose security policies require all internet egress to be inspected by an on-premises firewall. It is supported by Azure Firewall Standard and Premium (Basic does not support it), and it is configured by pointing the default route (0.0.0.0/0) in the AzureFirewallSubnet UDR to a VPN Gateway or ExpressRoute Gateway. Trade-offs: the on-prem firewall becomes a bottleneck, latency increases, and costs rise. Cloud-native-leaning companies rarely use it, but it's worth understanding as a required pattern in regulated industries.

NSGs (Network Security Groups) provide stateful L3-L4 control at the subnet/NIC level, are free of charge, and apply across every VNet by default. Azure Firewall provides L3-L7 control at the VNet level, is a paid service, and is used for organization-wide governance. Design principle: always apply NSGs for baseline security, and place Azure Firewall in the Hub VNet for advanced control, FQDN filtering, and threat intelligence. Concretely: control VM-to-VM traffic inside a subnet with NSGs by IP and port; control Spoke-to-Internet egress through the Hub's Azure Firewall with FQDN filtering and centralized logging. The two are complementary rather than competing, and using them together is the standard. Microsoft also recommends combining both. See the VNet complete design guide for details.

AZ-700 (Network Engineer Associate) covers Azure Firewall in depth — design decisions around Application Rules, Network Rules, DNAT, FQDN Tags, Firewall Manager, and Forced Tunneling appear frequently. AZ-104 (Administrator) covers the basics in Domain 4. AZ-305 (Solutions Architect Expert) covers selection from an architect's perspective. SC-100 (Cybersecurity Architect Expert) treats it as central to zero-trust network design. SC-500 (formerly AZ-500, GA September 2026) treats it as a major topic in Azure security implementation. Understanding Azure Firewall is an essential skill for any network or security engineer working with Azure.