Azure Firewall Manager policies

Learn how Azure Firewall Manager policies centralize and scale Azure Firewall configuration across subscriptions, regions, and virtual hubs. This guide explains the policy model, management options, association patterns, and includes practical CLI and Bicep examples to help you create and deploy Firewall Policies consistently.

What is Azure Firewall Manager?

Azure Firewall Manager is a centralized management service that sits above individual Azure Firewall instances and virtual hubs. It enables administrators to create, distribute, and manage Firewall Policies across many firewalls and environments, ensuring consistent security controls and simplified operations at scale. Key capabilities:

Centralized policy authoring and distribution
Support for cross-subscription and cross-region assignments
Layered/global + local policy model for baseline controls with environment-specific overrides
Multiple management interfaces for automation and integration

Flexible policy management

Firewall Policies can be created and managed through several Microsoft tooling options, allowing you to pick the approach that fits your automation and operational model:

Azure Portal — visual authoring and quick edits.
REST API — integrate with automation pipelines.
ARM / Bicep templates — infrastructure-as-code deployments.
Azure PowerShell — scriptable automation for PowerShell users.
Azure CLI — scriptable automation for Bash and CI systems.

The image illustrates "Flexible Policy Management" for Azure Firewall Manager, showing management options like Azure Portal, REST API, Templates, Azure PowerShell, and CLI.

Management options at a glance:

Interface	Use case	Example
Azure Portal	Manual authoring, review, and ad-hoc updates	Use the Firewall Manager blade to create policies
REST API	Integrate with external systems or custom tooling	https://docs.microsoft.com/rest/api/firewall/
ARM / Bicep	Declarative, repeatable infrastructure deployments	Bicep example below
Azure PowerShell	PowerShell-centric automation and runbooks	`New-AzFirewallPolicy -Name "MyPolicy" -ResourceGroupName "RG"`
Azure CLI	Shell scripts and CI/CD pipelines	`az network firewall policy create --name MyPolicy --resource-group RG --location eastus`

Example: Create a Firewall Policy with Azure CLI

az network firewall policy create \
  --name MyFirewallPolicy \
  --resource-group myResourceGroup \
  --location eastus \
  --tags "env=prod" "owner=security"

Example: Basic Bicep snippet to create a Firewall Policy

resource fwPolicy 'Microsoft.Network/firewallPolicies@2021-08-01' = {
  name: 'myFirewallPolicy'
  location: 'eastus'
  properties: {
    threatIntelMode: 'Alert'
  }
}

Association with multiple hubs or VNets

A single Firewall Policy can be associated with multiple Azure Firewall instances or virtual hubs (vHubs). When attached, the policy governs the firewall’s behavior for the deployment (for example, traffic filtering, NAT, application rules, TLS inspection settings, and logging). This helps avoid duplicated rules across environments and reduces configuration drift. Common association patterns:

One policy applied to multiple production hubs for uniform controls.
One global policy + per-hub local policies for exceptions and additional rules.
Dedicated policies per environment when isolation is required.

Cross-subscription and cross-regional support

Firewall Policies can be applied to firewall resources across subscriptions and regions. Azure Firewall Manager supports centralized policy assignment, but this requires proper RBAC and management scope configuration so the management account has rights over target resources.

Ensure your management/service account has the necessary RBAC permissions and management group or subscription scopes when assigning policies across subscriptions. Lack of appropriate access will prevent policy assignment and lifecycle management.

Layered (global) vs local policy model

A recommended deployment pattern is layered policies:

Global (baseline) policy: defined by central security teams to ensure organization-wide controls (allow/deny lists, logging, threat intelligence).
Local policy: defined by regional or application teams to add environment-specific rules or exceptions.

This layered approach balances centralized governance with local flexibility. The diagram below shows how a global policy can be pushed to many hubs while specific hubs may also combine global and local policies as needed.

The image is a diagram illustrating Azure Firewall Manager's cross-subscription and regional support, showing connections between different network hubs: "Prod Hub Vwan," "Staging Hub VNET," and "Dev Hub VNET," all utilizing global policies.

Use a global policy to enforce organization-wide controls (for example, deny lists, allow lists, and logging). Apply local policies for environment-specific exceptions or additional rules.

How to create, attach, and verify Firewall Policies

Below are practical examples to help you create a policy and attach it to an Azure Firewall or vHub.

Create a Firewall Policy (Azure CLI)

az network firewall policy create \
  --name GlobalPolicy \
  --resource-group infra-rg \
  --location eastus

Attach a Firewall Policy to an Azure Firewall (Azure CLI)

az network firewall update \
  --name MyAzureFirewall \
  --resource-group prod-rg \
  --firewall-policy /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/infra-rg/providers/Microsoft.Network/firewallPolicies/GlobalPolicy

Bicep example: create a firewall and attach a policy

resource fwPolicy 'Microsoft.Network/firewallPolicies@2021-08-01' existing = {
  name: 'GlobalPolicy'
}

resource firewall 'Microsoft.Network/azureFirewalls@2021-08-01' = {
  name: 'myAzureFirewall'
  location: 'eastus'
  properties: {
    sku: {
      name: 'AZFW_VNet'
      tier: 'Standard'
    }
    firewallPolicy: {
      id: fwPolicy.id
    }
  }
}

Verify the association (Azure CLI)

az network firewall show \
  --name MyAzureFirewall \
  --resource-group prod-rg \
  --query "firewallPolicy.id" \
  --output tsv

Policy design checklist

Define global baseline rules for all hubs (logging, threat intel, deny lists).
Use local policies sparingly for necessary exceptions.
Automate policy creation and assignment using Bicep/ARM or CLI in CI/CD pipelines.
Validate RBAC and management scopes before assigning cross-subscription policies.
Test policy impact in staging before applying to production.

Links and references

Now that you understand Azure Firewall Manager policy concepts, management options, and deployment patterns, you can design a layered policy framework and automate policy distribution across your organization.

Watch Video

Azure Firewall Manager

Using Azure Firewall Manager

​What is Azure Firewall Manager?

​Flexible policy management

​Association with multiple hubs or VNets

​Cross-subscription and cross-regional support

​Layered (global) vs local policy model

​How to create, attach, and verify Firewall Policies

​Policy design checklist

​Links and references

Watch Video

What is Azure Firewall Manager?

Flexible policy management

Association with multiple hubs or VNets

Cross-subscription and cross-regional support

Layered (global) vs local policy model

How to create, attach, and verify Firewall Policies

Policy design checklist

Links and references