5.4 Azure Firewall and Firewall Manager
📘Microsoft Azure Networking Solutions (AZ-700)
When you’re studying for the AZ-700 exam, one important skill is being able to look at a set of requirements and identify which Azure Firewall features meet them. This is a common scenario in real exams.
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Networks (VNets). Azure Firewall Manager is used to centrally manage multiple firewalls across your network.
Here’s what you need to know:
Step 1: Understand Azure Firewall Basics
Azure Firewall has several key features:
- Network rules – control traffic based on:
- Source IP / Destination IP
- Protocol (TCP, UDP, ICMP)
- Port numbers
- Application rules – control traffic to FQDNs (Fully Qualified Domain Names):
- These rules filter HTTP/HTTPS traffic based on the domain.
- You can allow or deny access to specific websites or services.
*.microsoft.combut block*.socialmedia.com. - Threat intelligence – integrates with Microsoft Threat Intelligence:
- Alerts or blocks traffic from malicious IP addresses and domains.
- Logging and monitoring – integrates with:
- Azure Monitor
- Log Analytics
- Event Hub for SIEM integration
- FQDN tags – simplify rules for common Azure services:
- Example:
Storage,SQL,KeyVaulttags allow traffic to all those services without specifying every URL.
- Example:
- Fully stateful firewall – keeps track of active connections, meaning you don’t need to open return traffic manually.
- High availability and scalability – automatically scales to handle large traffic loads.
Step 2: Understand Azure Firewall Manager
Azure Firewall Manager helps you manage multiple firewalls across subscriptions and VNets. Key features:
- Hub-and-spoke management – deploy firewalls in a hub and route traffic from spoke VNets.
- Policy management – define centralized rules (network and application rules) for all firewalls.
- Threat intelligence integration – enable security alerts across all firewalls.
- Route management – integrates with Azure Virtual WAN for traffic routing.
Step 3: Mapping Requirements to Features
In the exam, Microsoft might give you requirements like these:
| Requirement | Azure Firewall Feature to Use | Explanation |
|---|---|---|
| Block traffic to social media websites | Application rules | Application rules can block FQDNs like facebook.com |
| Allow SQL traffic from a subnet to a database | Network rules | Network rules control TCP/UDP ports and IPs |
| Automatically block traffic from known malicious sources | Threat intelligence-based filtering | Azure Firewall uses Microsoft Threat Intelligence |
| Log all network and application traffic for auditing | Diagnostic logs / Azure Monitor integration | Enables tracking, monitoring, and alerting |
| Simplify rules for Azure services like Storage | FQDN tags | Instead of listing every storage URL, use Storage tag |
| Centrally manage firewall rules across multiple VNets | Azure Firewall Manager policies | Central policy management simplifies rule deployment |
Tip for exam: Always match the type of traffic control requirement to the feature type:
- Network control → Network rules
- Domain/URL control → Application rules
- Malicious traffic alert → Threat intelligence
- Centralized management → Firewall Manager
Step 4: Practical Exam Pointers
- You may see diagrams or scenarios with multiple VNets. Ask yourself:
- Do I need centralized control? → Firewall Manager
- Do I need domain-level blocking? → Application rules
- Do I need port/protocol control? → Network rules
- Remember stateful vs stateless:
- Azure Firewall is stateful, so inbound/outbound return traffic is automatically allowed for existing connections.
- Policy assignment hierarchy:
- You can have global policies (applied to multiple firewalls) or local policies (specific firewall).
- Integration:
- Works with Azure Monitor, Log Analytics, and Virtual WAN.
- These integrations often show up in scenario-based exam questions.
Step 5: Summary Table for Exam Memory
| Requirement Type | Azure Firewall Feature |
|---|---|
| IP, port, protocol control | Network rules |
| URL/Domain access control | Application rules |
| Central management | Azure Firewall Manager |
| Detect/block malicious traffic | Threat intelligence |
| Simplify rules for Azure services | FQDN tags |
| Monitor, log, or alert | Diagnostic logs + Azure Monitor |
This table is great to memorize for the exam, because almost every scenario will fit into one of these categories.
✅ Key Takeaways for Students
- Always identify the type of requirement first.
- Map the requirement to the correct Azure Firewall feature.
- Know Firewall Manager is for centralized control and policy management.
- Remember stateful firewall behavior: return traffic does not need a separate rule.
- FQDN tags and application rules make rule management easier.
