Cloud-native, next-generation firewall to protect your Azure Virtual Network resources
Protect your workloads in Azure Virtual Network
Help secure your digital assets using cloud-native firewall capabilities with built-in high availability, auto-scalability, and zero maintenance.
Threat intelligence–based filtering
Enable real-time alerts and deny traffic from/to known malicious IP addresses and domains.
Deploy and scale slowly over the course of several years
Simplify deployment and management of your network security with a scalable and highly available cloud native firewall.
Full visibility and protection
Transport Layer Security (TLS) inspection prevents malware from being transmitted through encrypted connections.
Centrally manage security across all virtual networks with a common set of network and application rules.
Strengthen your network security posture
Get advanced threat protection that meets the needs of highly sensitive and regulated environments. Microsoft Intelligent Security Graph powers Microsoft threat intelligence and is used by multiple services including Microsoft Defender family.
Deploy a stateful firewall in minutes
Enable turnkey firewall security capabilities in Azure Virtual Network to control and log access to apps and resources. Azure Firewall supports filtering for both inbound and outbound traffic, internal spoke-to-spoke connections and hybrid connections through Azure VPN and ExpressRoute gateways.
Prevent malware and viruses from spreading
Azure Firewall decrypts outbound traffic, performs required security checks, and then encrypts the traffic to the destination. It works in conjunction with URL filtering and web categories by letting administrators allow or deny user access to website categories such as gambling or social media.
Inspect traffic in real time
The intrusion detection and prevention system (IDPS) capability uses signatures to continuously monitor activities, generate alerts, log information and optionally attempt to block the attack. It can detect attacks in all ports and protocols for non-encrypted traffic. Encrypted traffic utilises the TLS inspection capability for decryption.
Why Trust Azure Firewall?
Microsoft invests more than USD 1 billion annually on cybersecurity research and development.
We employ more than 3,500 security experts dedicated to data security and privacy.
Azure has more certifications than any other cloud provider. View the comprehensive list.
Azure Firewall pricing
Setup is easy with billing comprised of a fixed per-hour consumption rate and variable fees based on traffic. There are no upfront costs or termination fees—pay only for what you use.
Get started with an Azure free account
Start free. Get $200 credit to use within 30 days. While you have your credit, get free amounts of many of our most popular services, plus free amounts of 40+ other services that are always free.
After your credit, move to pay as you go to keep building with the same free services. Pay only if you use more than your free monthly amounts.
After 12 months, you'll keep getting 40+ always-free services—and still pay only for what you use beyond your free monthly amounts.
Trusted by companies of all sizes
Rockefeller Capital Management
Joe Ferlisi, CIO and Chief Security Officer, Rockefeller Capital Management
"Microsoft has created a single ecosystem that incorporates the scalability and security of Azure, Microsoft 365, and Dynamics 365, and which will grow synergistically over time."
Isidro Rodriguez, Head of Digital Transformation, SaaS Operations, NCR
"Azure Security Center is one of the most critical security tools managing the Azure ecosystem at NCR. With its single pane of glass, we get an overview of security across our Azure cloud deployments in real time."
MVP Health Care
Michael Della Villa, CIO and Head of Shared Services, MVP Health Care
"As we looked at other vendors and platforms, we realized that it was a no-brainer. Microsoft offers the cohesive solution we need. Everything it brings to the table fits beautifully with our direction. It has become an outstanding support for us."
Barry King, Cloud Infrastructure chief Technology Officer, Costain
"With Virtual WAN and Azure Firewall, we can see all traffic moving across our networks, control it with Azure Firewall, and feed the logs into Azure Sentinel for our SOC. This definitely helps us reduce risk; seeing is knowing."
Azure Firewall resources and documentation
Related products and services
Frequently asked questions about Azure Firewall
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall service with built-in high availability and unrestricted cloud scalability. You can centrally create, enforce and log application and network connectivity policies across subscriptions and virtual networks.
Set up Azure Firewall in the Azure portal or with PowerShell, REST API or templates. Read a tutorial for step-by-step instructions.
Yes. Azure Firewall supports inbound and outbound filtering. Inbound protection is typically used for non-HTTP/S protocols such as RDP, SSH and FTP protocols. For the best inbound HTTP/S protection, use a web application firewall such as Azure Web Application Firewall (WAF).
Azure Firewall is integrated with Azure Monitor for viewing and analysing firewall logs. Logs can be sent to Log Analytics, Azure Storage or Event Hubs. They can be analysed in Log Analytics or by different tools such as Excel and Power BI. For more information, see Tutorial: Monitor Azure Firewall logs.
Yes, Azure Firewall Premium provides advanced threat protection that meets the needs of highly sensitive and regulated environments, such as the financial services and healthcare industries. A signature-based IDPS looks for specific patterns to rapidly detect attacks. These patterns can include byte sequences in network traffic or known malicious instruction sequences used by malware. There are more than 58,000 signatures in more than 50 categories which are updated in real time to protect against new and emerging exploits. The exploit categories include malware, phishing, coin mining, and Trojan attacks.
Yes, Azure Firewall allows you to inspect traffic destined for a private endpoint. Private endpoints enable Azure resources deployed in a virtual network to communicate privately with private link resources. You may need to inspect or block traffic from clients to the services exposed via private endpoints using Azure Firewall.
For secure access to platform services, we recommend service endpoints. You can choose to enable service endpoints in the Azure Firewall subnet and disable them on the connected spoke virtual networks. This way you benefit from both features—service endpoint security and central logging for all traffic.