Azure Firewall – Consider Downgrading to Standard or Basic

The Azure Firewall downgrade policy flags Premium-tier Azure Firewall deployments that use no Premium-only features. It recommends moving them to Standard or Basic. Azure Firewall Premium bills a higher fixed hourly deployment fee than Standard or Basic, so an unused Premium tier adds cost with no security benefit. Apply this policy to firewalls that do not need TLS inspection, intrusion detection and prevention (IDPS), or full-path URL filtering.

Why This Policy Matters

How It Helps Reduce Cloud Costs

Azure Firewall is billed in two parts: a fixed fee for every hour the firewall is deployed, and a fee for every GB of data processed. The deployment fee is charged whether the firewall handles one request or one million.

The three Azure Firewall tiers differ mainly in that fixed fee. In East US, the list price per deployment hour is $1.75 for Premium, $1.25 for Standard, and $0.395 for Basic.

Azure Firewall Premium adds three capabilities on top of Standard:

• TLS inspection: decrypts outbound traffic so the firewall can inspect it.

• IDPS: signature-based intrusion detection and prevention.

• URL filtering: filtering on the full URL path, not only the domain.

Web categories are not Premium-only. Azure Firewall Standard supports them too, matched on FQDN rather than the full URL.

Teams often choose Premium at deployment time "just in case." If the attached firewall policy configures none of those features, the Premium tier pays for capabilities the firewall never uses.

This policy is a cost decision only when the security requirement is absent. A firewall that runs IDPS or TLS inspection needs Premium, and this policy does not apply to it.

Potential Savings

Azure Firewall savings come almost entirely from the lower hourly deployment fee. The table below uses East US list prices, 730 hours per month, and 2 TB (2,048 GB) of data processed.

Figures are Azure retail list prices for East US. Prices vary by region and exclude public IP addresses and optional prescaling capacity units.

Moving one Azure Firewall from Premium to Standard saves about $365 per month, or about $4,380 per year. Moving the same firewall to Basic saves about $889 per month, or roughly $10,700 per year.

The Basic saving shrinks as traffic grows. Basic charges $0.065 per GB processed, about four times the Standard rate.

At roughly 12.7 TB processed per month, an Azure Firewall Basic deployment costs about the same as Standard. Above that volume, Standard is cheaper.

Implementation Guide

Infrastructure-as-Code Example (Terraform)

The following examples show an Azure Firewall deployed on Premium with no Premium features configured, and the corrected configuration on Standard.

Non-compliant configuration: Premium tier with no Premium features

resource "azurerm_firewall_policy" "hub" {
  name                     = "fwpol-hub-premium"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Premium"
  threat_intelligence_mode = "Alert"

  # No intrusion_detection block
  # No tls_certificate block
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"
  firewall_policy_id  = azurerm_firewall_policy.hub.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

resource "azurerm_firewall_policy" "hub" {
  name                     = "fwpol-hub-premium"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Premium"
  threat_intelligence_mode = "Alert"

  # No intrusion_detection block
  # No tls_certificate block
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"
  firewall_policy_id  = azurerm_firewall_policy.hub.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

resource "azurerm_firewall_policy" "hub" {
  name                     = "fwpol-hub-premium"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Premium"
  threat_intelligence_mode = "Alert"

  # No intrusion_detection block
  # No tls_certificate block
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"
  firewall_policy_id  = azurerm_firewall_policy.hub.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

This Azure Firewall pays the Premium deployment fee while the attached firewall policy configures no IDPS and no TLS inspection. This is a common source of wasted spend in hub networks built from a template.

Compliant configuration: Standard tier with a Standard firewall policy

resource "azurerm_firewall_policy" "hub_standard" {
  name                     = "fwpol-hub-standard"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Standard"
  threat_intelligence_mode = "Alert"
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  firewall_policy_id  = azurerm_firewall_policy.hub_standard.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

resource "azurerm_firewall_policy" "hub_standard" {
  name                     = "fwpol-hub-standard"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Standard"
  threat_intelligence_mode = "Alert"
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  firewall_policy_id  = azurerm_firewall_policy.hub_standard.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

resource "azurerm_firewall_policy" "hub_standard" {
  name                     = "fwpol-hub-standard"
  resource_group_name      = azurerm_resource_group.network.name
  location                 = azurerm_resource_group.network.location
  sku                      = "Standard"
  threat_intelligence_mode = "Alert"
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  firewall_policy_id  = azurerm_firewall_policy.hub_standard.id

  ip_configuration {
    name                 = "configuration"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

The sku_tier value on azurerm_firewall changes from Premium to Standard. The firewall resource name stays the same, so Terraform plans an in-place update to the firewall.

The Azure Firewall Policy is a new resource with sku = "Standard". Changing sku on an existing azurerm_firewall_policy forces Terraform to replace that policy, and Azure does not attach a Premium policy to a Standard firewall.

Creating a separate Standard policy avoids a destroy and create on the policy that the firewall is still using. Roll the change out in three pull requests so the firewall never runs without rules:

1. Add the Standard policy and a copy of every azurerm_firewall_policy_rule_collection_group, pointed at the new policy ID. Apply it.

2. Change sku_tier and firewall_policy_id on the azurerm_firewall. Apply it.

3. Remove the old Premium policy and its rule collection groups.

Switching the firewall in the same apply that creates the rule collection groups is risky. Terraform can attach the new policy before its rules exist, which drops traffic until the rules finish creating.

Step-by-Step Fix Instructions

1. Search Terraform code for sku_tier = "Premium" on azurerm_firewall resources, including shared hub modules and .tfvars files.

2. For each Premium Azure Firewall, open the attached azurerm_firewall_policy. Check for an intrusion_detection block with mode set to Alert or Deny, and for a tls_certificate block.

3. Check application_rule blocks in each azurerm_firewall_policy_rule_collection_group for terminate_tls = true or destination_urls. Either one means the firewall uses TLS inspection or URL filtering and needs Premium, so skip it.

4. Choose the target tier. Use Standard for production hubs. Consider Basic only for small environments with steady traffic under 250 Mbps.

5. Create a new azurerm_firewall_policy with sku = "Standard" and copies of the rule collection groups. Apply this first, on its own.

6. In a second change, set sku_tier to Standard and update firewall_policy_id on the azurerm_firewallresource.

7. Run terraform plan. Confirm the firewall shows an in-place update, not a replacement.

8. Apply during a change window, then confirm in the Azure portal that the firewall shows the Standard tier.

9. Add Infracost to CI/CD so new Premium Azure Firewall resources are flagged in pull requests before they merge.

Best Practices

• Default shared hub modules to sku_tier = "Standard". Require a documented reason, such as a compliance control that mandates IDPS, for any new Premium Azure Firewall.

• Downgrade non-production firewalls first. Confirm that application and network rules behave the same before changing production.

• Keep Premium where TLS inspection or IDPS is an audited control. Removing a required control to save money is a compliance failure, not a saving.

• Treat Basic as a small-environment option. Azure Firewall Basic is limited to 250 Mbps of throughput and cannot be changed to Standard later.

• Review Azure Firewall tiers alongside the firewall policy, because the policy, not the firewall, shows whether Premium features are in use.

Tools and Scripts

How does Infracost detect Azure Firewall Premium automatically?

The Azure Firewall downgrade policy is available in Infracost, including in the free trial. When Infracost runs in CI/CD, it checks Azure Firewall resources in each pull request. Findings appear in the PR comment with the file and line to change.

This moves the tier decision to code review. An engineer sees the Premium finding before merge, rather than in a FinOps ticket after the firewall has billed for months.

Infracost also scans connected repositories for Premium Azure Firewall resources already in code. FinOps and platform teams can burn down that backlog over time, and track issues prevented in pull requests separately from existing issues fixed.

Each policy can warn engineers or block the pull request. Teams can also limit the policy to new resources only, so an unrelated change does not force a firewall tier change.

To find Premium Azure Firewall tiers in a Terraform codebase:

grep -rnE 'sku_tier[[:space:]]*=[[:space:]]*"Premium"' --include="*.tf" --include="*.tfvars"

grep -rnE 'sku_tier[[:space:]]*=[[:space:]]*"Premium"' --include="*.tf" --include="*.tfvars"

grep -rnE 'sku_tier[[:space:]]*=[[:space:]]*"Premium"' --include="*.tf" --include="*.tfvars"

To list Azure Firewall deployments and their tiers with the Azure CLI (requires the azure-firewall extension):

az network firewall list \
  --query "[].{name:name, resourceGroup:resourceGroup, tier:sku.tier}" \
  --output

az network firewall list \
  --query "[].{name:name, resourceGroup:resourceGroup, tier:sku.tier}" \
  --output

az network firewall list \
  --query "[].{name:name, resourceGroup:resourceGroup, tier:sku.tier}" \
  --output

If Terraform manages an Azure Firewall, change sku_tier in code rather than in the Azure portal. Otherwise the next terraform apply sets the firewall back to Premium.

Examples of Impact

Savings from the Azure Firewall downgrade policy are fixed per firewall, so they grow with the number of hubs and regions.

Illustrative example: a multi-region hub network. A platform team runs four regional hub firewalls on Premium from a shared module. None of them configure IDPS or TLS inspection. Changing the module to Standard saves about $365 per firewall per month, or roughly $17,500 per year across the four hubs.

Illustrative example: development environments. A team runs a separate Premium Azure Firewall in each of three small development VNets. Traffic stays well under 250 Mbps and a few hundred GB per month, so Basic fits. Each firewall drops from roughly $1,280 to under $320 per month.

(These are illustrative scenarios, not specific customer accounts.)

Considerations and Caveats

The Azure Firewall downgrade policy is low risk when no Premium feature is configured. It needs judgment in a few cases.

• Compliance controls. Some frameworks require IDPS or TLS inspection. Confirm with the security team before downgrading a firewall that sits in a regulated data path.

• Firewall policy replacement. Changing sku on an azurerm_firewall_policy forces Terraform to replace that policy. Create a new Standard policy instead of editing the Premium one in place.

• Basic replaces the firewall. Azure Firewall Basic always runs with a Management NIC, set in Terraform through the management_ip_configuration block. Adding that block forces Terraform to replace the azurerm_firewallresource, so plan the Basic path as a migration.

• Basic limits. Azure Firewall Basic supports up to 250 Mbps, threat intelligence in alert mode only, and no DNS proxy. Basic cannot be changed to Standard later.

• Scale limit on the in-place change. Microsoft documents the zero-downtime Premium to Standard change for firewalls running four or fewer instances. Larger deployments need to scale down first.

Related Policies and Concepts

• Azure Virtual Machines - Consider using a preferred instance type: an Azure Compute-group policy that restricts resources to an approved list of SKUs, the same control applied to virtual machine sizes.

• Azure Database - consider removing geo-redundant backups in non-production projects: another Azure policy that removes a paid capability a workload does not need.

• Storage Account - consider disabling public network access: an Azure network security policy that pairs with firewall design in hub-and-spoke networks.

• Amazon VPC - consider avoiding multiple NAT gateways for a single subnet: the AWS equivalent of paying fixed hourly fees for network infrastructure that adds no capability.

• Amazon VPC - consider avoiding multiple VPC endpoints for the same service: another network policy that cuts fixed per-hour charges without reducing connectivity.

Frequently Asked Questions (FAQs)

Is this policy supported in Infracost?

Yes. The Azure Firewall downgrade policy is supported in Infracost and available in the free trial. Infracost flags Premium Azure Firewall resources in pull requests, with the file and line to change.

Can this policy be customized?

Yes. Teams can configure how Infracost enforces the Azure Firewall downgrade policy. A finding can warn engineers or block the pull request, and the policy can be limited to new resources only.

Does Infracost automatically fix violations?

No. Infracost reports each Azure Firewall Premium resource in the pull request. Confirming that no Premium features are in use, and choosing between Standard and Basic, is a decision the team makes.

Is this policy cloud-agnostic?

No. The Azure Firewall downgrade policy targets Microsoft Azure through the azurerm Terraform provider. AWS and Google Cloud firewall services use different pricing models and different Terraform resources.

Which Azure Firewall features require the Premium tier?

TLS inspection, intrusion detection and prevention (IDPS), and URL filtering on the full URL path require Azure Firewall Premium. Web categories are also available in Azure Firewall Standard, matched on FQDN only.

Does downgrading Azure Firewall Premium to Standard cause downtime?

Microsoft documents the Azure Firewall Premium to Standard SKU change as a zero-downtime operation for firewalls with four or fewer instances. Premium features must be disabled and a Standard firewall policy attached first.

When is Azure Firewall Basic the wrong choice?

Azure Firewall Basic is the wrong choice when traffic can exceed 250 Mbps, or when DNS proxy or threat intelligence deny mode is required. Above roughly 12.7 TB of data processed per month, Azure Firewall Basic costs more than Standard because of its higher per-GB rate.

How often should I review Azure Firewall tiers?

Teams running Infracost in CI/CD get an Azure Firewall tier check on every pull request that adds a firewall. For existing Azure Firewall deployments, a quarterly review of Premium feature usage is a reasonable cadence.