Cloud Security with Azure Firewall – Doing it Right!

In today’s digital landscape, where businesses increasingly rely on cloud services to drive innovation and efficiency, ensuring robust cybersecurity measures is paramount. As organisations embrace the transformative potential of the cloud, they must also address the evolving challenges of securing their digital assets and sensitive data from malicious threats. At the forefront of cloud security strategies stands the firewall—a cornerstone of network defence that acts as a barrier between trusted internal networks and untrusted external networks, such as the internet.

One of the challenges with cloud network security is that many organisations carry forward assumptions from on-premise designs. In the cloud, network boundaries are more fluid, traffic patterns are less predictable, and identity frequently becomes a stronger control than IP-based trust. Azure Firewall is most effective when it is treated not as a perimeter replacement, but as a policy enforcement and inspection point within a broader, identity-aware architecture.

Even in the Zero Trust world we find ourselves in today where the perimeter cannot be trusted, or on occasions may not be present at all, in the context of the Azure cloud environment, Azure Firewall remains a powerful solution designed to fortify network security and safeguard cloud workloads against a myriad of cyber threats.

At a high level, we cover the following ground in this article:

Fundamentally, the purpose of a firewall is to regulate and monitor the flow of network traffic, enforcing predetermined security policies to mitigate risks and protect against unauthorized access, malware, and other malicious activities. By analysing incoming and outgoing traffic based on predefined rules, firewalls serve as a gatekeeper, allowing legitimate data to pass through while blocking or filtering potentially harmful content.

Deploying a firewall, such as Azure Firewall, within the Azure cloud environment offers a multitude of benefits for businesses seeking to bolster their security posture:

By leveraging Azure Firewall within the Azure cloud environment, businesses can fortify their network defences, mitigate cybersecurity risks, and uphold the integrity and confidentiality of their digital assets. With its robust features, scalability, and integration capabilities, Azure Firewall empowers organisations to embrace the transformative potential of the cloud while maintaining rigorous security standards.

When it comes to securing digital assets within your Azure environment, you are presented with a variety of tools and services to fortify their defences against cyber threats. Among these are Azure Firewall, Web Application Firewall (WAF), and Network Security Groups (NSGs), each offering distinct capabilities tailored to address specific security requirements. Let’s delve into a comparative analysis of these three Azure security solutions:

Azure Firewall serves as a cloud-native, fully stateful firewall as a service, designed to protect Azure virtual network resources by regulating inbound and outbound traffic based on user-defined rules. Azure Firewall has a comprehensive list of features and capabilities:

Web Application Firewall (WAF) is a security solution specifically designed to protect web applications from common web-based attacks, such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). WAFs have a more focused set of features and capabilities:

Network Security Groups (NSGs) are a basic networking security feature in Azure, providing inbound and outbound security rules to control network traffic to and from Azure resources within a virtual network. Whilst more limited compared to the previous two technologies, the features remain very capable:

In summary, Azure Firewall, Web Application Firewall, and Network Security Groups each serve distinct security purposes within the Azure environment, offering varying levels of protection and customisation options. By understanding the unique features and capabilities of each solution, organisations can design and implement robust security architectures tailored to their specific security requirements and compliance standards.

Firewalls are commonly regarded as a foundational security control, providing essential protection for network infrastructure by regulating inbound and outbound traffic based on predetermined rules. However, there are scenarios in which deploying a firewall within the Azure environment might not be the most suitable approach. Let’s explore some of these:

While firewalls play a crucial role in network security, there are instances in which deploying a firewall within your Azure environment may not be appropriate or necessary. Alternative architecture patterns and the technologies discussed earlier such as WAFs and/or NSGs may allow you to secure your workloads and data, particularly if supported with other capabilities such as access control and encryption. It’s essential for you to carefully assess your specific architectural requirements, security considerations, and compliance obligations to determine whether deploying a firewall aligns with your overall security strategy and objectives.

Azure Firewall serves as a pivotal component in safeguarding your Azure cloud workloads, providing top-tier threat protection seamlessly integrated into the Azure infrastructure. Azure Firewall is available in three variants, and it is imperative to ensure you select the correct one to appropriately balance organisations risk appetite with security features and cost. We’ll delve into its three distinct variants (SKUs) in the following sections, but first Microsoft at a high level recommend the following:

While Azure Firewall offers a broad set of capabilities, its real value lies in centralisation and consistency, not deep protocol-specific inspection. It excels at enforcing uniform policy across environments, controlling east-west and north-south traffic, and providing a common inspection layer for multiple workloads. Understanding these strengths — and their limits — is critical when deciding where Azure Firewall fits in an overall security architecture.

Azure Firewall Standard offers a comprehensive suite of features to bolster network security. Azure Firewall Standard provides a fully stateful firewall as a service, ensuring robust threat protection for your cloud workloads running in Azure. It offers both east-west (Azure to Azure, OR Azure to on-premise) and north-south (Azure to Internet) traffic inspection, catering to various security requirements. Check out: Microsoft’s official Azure Firewall Standard Features.

Key features of Azure Firewall Standard include:

Azure Firewall Premium extends its capabilities to meet the demands of highly sensitive environments. Microsoft’s official Azure Firewall Premium Features. Key features above and beyond Standard include:

Azure Firewall Basic caters to small and medium-sized businesses, offering essential protection at an affordable price point. Microsoft’s official Azure Firewall Basic Features, highlights include:

You can centralise your firewall management across multiple subscriptions with Azure Firewall Manager, empowering you to apply consistent network policies and configurations effortlessly, ensuring a robust security posture across the board. Azure Firewall Manager simplifies firewall management by providing a centralised platform to define and enforce network security policies, allowing you to streamline security operations and maintain compliance with regulatory requirements. Check out Microsoft’s official Azure Firewall Manager page.

In practice, the effectiveness of Azure Firewall is less about where it is deployed and more about what assumptions it enforces. Used well, it becomes a control that validates traffic flows against intent — which services should talk, which protocols are expected, and which paths are explicitly disallowed. Used poorly, it becomes a permissive transit layer that merely centralises risk instead of reducing it.

Deploying a firewall within your network infrastructure is a critical step in fortifying your defences against cyber threats and safeguarding your digital assets. However, the effectiveness of a firewall implementation extends beyond the mere deployment of the device itself. It encompasses various aspects, including designing a secure network topology, defining a robust firewall rulebase, and adhering to Azure-specific guidance in cloud environments. In this section, we delve into essential best practices to ensure that your firewall deployment not only meets your security requirements but also aligns with industry standards and regulatory compliance.

The topics we will cover are:

In the following sections, we provide actionable insights and practical recommendations to guide you through the process of deploying and managing firewalls effectively. Whether you’re securing an on-premise network or transitioning to the cloud with Azure, adopting these best practices will bolster your security posture and strengthen your defence against cyber threats.

Defining an Azure network topology is fundamental to establishing a robust landing zone architecture that facilitates effective communication between applications while ensuring security and scalability. This section delves into various technologies and topology approaches for Azure deployments, focusing on Virtual WAN-based and traditional topologies.

Azure Virtual WAN offers a managed solution for large-scale interconnectivity requirements, reducing network complexity and modernizing organisational networks. Consider Virtual WAN topology when:

In contrast, a traditional hub-and-spoke network topology offers customised, enhanced-security networks in Azure, where routing and security are managed manually. Go for this topology when:

Azure landing zones recommend either Virtual WAN-based or traditional hub-and-spoke architectures. As business requirements evolve, Azure Virtual Network Manager facilitates topology changes without disrupting existing deployments. It supports three types of topologies across subscriptions:

Virtual Network Manager enables dynamic grouping of virtual networks, applying configurations to groups rather than individual networks. This approach streamlines management, connectivity, configuration, topology, and security rules, accommodating application migration, modernisation, and innovation at scale.

By adhering to these recommendations, organisations can establish secure and scalable network topologies in Azure, facilitating seamless communication between applications while maintaining robust security controls. Please visit Define an Azure Network Topology for further information.

Effectively managing firewall rules is crucial for maintaining the security and integrity of your network infrastructure. By adhering to best practices, you can optimise rule sets to mitigate risks, enhance visibility, and streamline traffic management. The following are some key best practices.

Note: Logging from Azure Firewall is most valuable when it supports decision-making, not just troubleshooting. High-quality firewall telemetry helps teams understand which controls are being exercised, where traffic is routinely denied, and which rules are rarely — or never — triggered. Over time, this insight can inform rule tightening, segmentation improvements, and architectural simplification.

By implementing these best practices, you can optimize your firewall rulebase to effectively mitigate threats, enforce security policies, and maintain regulatory compliance. Regularly review and update rule sets to adapt to evolving threats and operational requirements, ensuring continuous protection of your network infrastructure.

It is recommended that at least once a year, or after any substantial configuration change that the rulebase is reviewed. Network penetration testing can anecdotally comment on firewall rules, however a comprehensive firewall security review is the recommended route as it has full visibility of the entire configuration. A comprehensive review of Azure Firewall rules and NSG configurations is included within our Azure Security Assessment.

When deploying Azure Firewall, adhering to architectural best practices is essential to ensure reliability, security, cost optimisation, operational excellence, and performance efficiency. Based on the five pillars of architecture excellence, outlined below are key recommendations tailored for Azure Firewall deployments:

By following these Azure-specific guidance recommendations, organisations can effectively deploy and manage Azure Firewall deployments, ensuring robust security, high availability, and optimal performance across their Azure environments.

The topic of firewalls in general and Azure Firewall in particular is vast, this article has attempted to cover the core aspects of the subject. The following blog posts, all sourced from the Azure Network Security Blog, may prove beneficial for those with a niche/focused requirement.

Azure Firewall is best viewed as a breadth control: it provides consistent enforcement across protocols, environments, and workloads. On its own, that breadth does not guarantee strong security outcomes — but when combined with complementary, depth-focused controls, it forms a reliable foundation for enforcing intent in cloud networks.

In practice, Azure Firewall is often combined with layer-7 controls such as Application Gateway or Front Door, allowing organisations to balance broad network enforcement with deep application-level inspection — a pattern commonly seen in Zero Trust architectures.

In conclusion, implementing a robust firewall solution and securing network topology are paramount in Azure cloud environments to safeguard data, applications, and infrastructure from evolving cyber threats. By leveraging Azure Firewall alongside Web Application Firewall and Network Security Groups, organisations can fortify their defences and enforce granular access controls, ensuring compliance with regulatory requirements and industry best practices.

While firewalls are considered a default security control, deploying them blindly without considering the specific requirements and network topology is unlikely to be appropriate. Organisations should carefully assess their needs, considering factors such as network integration, traffic routing, and user behaviour, to determine the most suitable approach.

Furthermore, securing network topology plays a crucial role in defining how applications communicate within the Azure environment. Whether adopting Virtual WAN-based or traditional hub-and-spoke architectures, organisations must prioritise reliability, security, cost optimisation, operational excellence, and performance efficiency to achieve a robust and scalable network infrastructure.

In essence, by adopting best practices for firewall deployment and network topology security, organisations can strengthen their defence posture, mitigate security risks, and enable seamless communication and collaboration within the Azure cloud environment. As the threat landscape continues to evolve, investing in comprehensive security measures is imperative to safeguarding critical assets and maintaining business continuity in today’s digital landscape.