Azure Firewall Manager serves as the central control plane to configure and secure multiple firewall instances across different environments. Security administrators use this service to create and distribute firewall policies that govern traffic for both secured virtual hubs and standard virtual networks. By establishing a hierarchical model, an organization can deploy a parent policy that enforces global security rules alongside child policies that inherit those rules. This relationship ensures that child policies can only restrict traffic further or add local rules, meaning they can never bypass or weaken the security boundary defined by the parent.
Inside each firewall policy, rules are organized into rule collection groups that are processed based on an assigned numeric priority. Within these groups, traffic is evaluated through three types of rule collections: DNAT rules for inbound port translation, network rules for filtering traffic by IP address and port, and application rules for filtering by domain names. When traffic enters the firewall, DNAT rules are processed first to translate incoming packets, followed by network rules, and finally application rules. If a connection matches a DNAT or network rule that permits or denies the traffic, the evaluation stops, making the selection of priority numbers critical for proper traffic routing.
To protect against active network threats, Microsoft Threat Intelligence feeds can be integrated directly into your firewall policies to identify traffic from known malicious destinations. Administrators can configure threat intelligence to run in alert only mode to log suspicious behavior, or alert and deny mode to block the traffic automatically. To prevent accidental disruptions, trusted destinations can be exempted using allowlists that bypass these intelligence checks. Organizations can use Azure Policy to enforce these settings at scale, ensuring that every newly deployed firewall automatically enables threat intelligence and complies with corporate configuration standards.
Maintaining visibility across a distributed network requires forwarding firewall activity to a centralized location for analysis. Enabling diagnostic logging allows the firewall to capture detailed records of rule matches, threat intelligence alerts, and network address translations. These logs are sent to Azure Monitor and stored in a Log Analytics workspace, where security teams can query the data to troubleshoot connectivity or investigate security events. For long-term retention and advanced threat hunting, these logs can also be streamed directly to a security information and event management (SIEM) system.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Azure Firewall Manager serves as the central control plane to configure and secure multiple firewall instances across different environments by creating and distributing firewall policies for secured virtual hubs and standard virtual networks.
A parent policy enforces global security rules, and child policies inherit those rules but can only restrict traffic further or add local rules, meaning they can never bypass or weaken the security boundary defined by the parent.
Traffic is evaluated with DNAT rules processed first for inbound port translation, followed by network rules for filtering by IP and port, and finally application rules for filtering by domain names, with evaluation stopping if a DNAT or network rule matches.
Microsoft Threat Intelligence feeds can be integrated into firewall policies to identify traffic from known malicious destinations and configured to run in alert only mode to log behavior or alert and deny mode to block traffic automatically, with trusted destinations exempted via allowlists.
StudyCerts
StudyCerts