Azure Firewall

What it is

Azure Firewall is a managed, stateful network firewall service for Azure workloads. It can inspect both traffic entering or leaving a network (north-south) and traffic moving between network segments (east-west), then allow or deny it according to configured rules.

Why it exists

Network security groups protect individual subnets or network interfaces. Azure Firewall gives a team a central inspection point and shared rule policy when traffic must be routed through it. It can complement NSGs; the two do not replace one another automatically.

Key ideas

• Network rules use IP addresses, protocols, and ports. Application rules use fully qualified domain names (FQDNs) for supported application traffic. NAT rules can map inbound traffic to a private destination.
• A Firewall Policy holds reusable rule collections and configuration that can be applied to one or more firewalls. It makes shared governance clearer than maintaining unrelated rules in each deployment.
• Azure Firewall has Basic, Standard, and Premium SKUs. Standard offers L3–L7 filtering and Microsoft threat-intelligence feeds. Premium adds capabilities such as signature-based intrusion detection and prevention. Select features from the current SKU documentation rather than assuming every firewall includes Premium inspection.
• User-defined routes can send selected traffic to the firewall for inspection. This is a routing design choice: a rule cannot inspect traffic that never reaches the firewall.
• Azure Firewall can run in virtual-network and Virtual WAN secure-hub designs. Its exact subnet, public-IP, availability-zone, and capacity configuration depends on the chosen deployment design and SKU.

How it fits

[VM/app] ──selected UDR──► [Azure Firewall] ──► [allowed destination]
                              │  Application / network / NAT rules
                              ▼
                           logging and alerting

Diagrams courtesy of Microsoft Learn / Azure docs: firewall/overview

Northwind example

Maya routes Northwind’s application subnet outbound traffic through Azure Firewall. An application rule permits the ordering service to reach only its approved payment-provider FQDN, while network rules control other permitted IP-and-port paths. The team reviews firewall logs when checkout fails. It does not assume the firewall can protect a workload that has a direct route around it, or that an allow rule proves the remote service is safe.

Azure Firewall, NSG, and WAF

Service	Primary boundary
Azure Firewall	Central network and application traffic inspection and control.
[[nsg	Network security group]]
Web Application Firewall	HTTP(S) web-attack protection for supported web entry points.

Use the services according to traffic path and threat model. They can work together.

Common confusion

• Azure Firewall is stateful; it does not make NSGs “stateless.” NSGs are also stateful, but they operate at a different scope and feature set.
• Threat intelligence and advanced inspection do not remove the need for least privilege, patching, identity controls, and application security.
• A firewall rule governs network traffic, not whether a caller is authorized to read a specific order or customer record.

Related

Home · nsg · route-table · virtual-wan · ddos-protection · vnet

Sources and re-audit

• Microsoft Learn — What is Azure Firewall?, checked 2026-09-16.