Azure Firewall
Does ZopNight manage Azure Firewall?
Azure Firewall bills per deployment-hour plus data processed, starting at roughly $900 a month for the Standard SKU before a single packet flows. ZopNight attributes that fixed spend from Cost Management and checks 60 days of Azure Monitor metrics to show whether each firewall actually processes meaningful traffic.
Rules that fire on Azure Firewall
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery and cost visibility only. |
Azure Firewall is a managed, stateful network firewall billed per deployment-hour plus data processed, starting at roughly $900 per month for Standard. A firewall protecting an empty dev VNet is a very expensive placeholder.
Deployment-hours dominate the firewall bill
The meter has two parts: a fixed charge for every hour the firewall is deployed, and a smaller per-GB charge for data it processes. For most deployments the hourly component is nearly the whole bill. Standard runs to roughly $900 a month deployed; Premium, with TLS inspection and IDPS, costs materially more. Nothing about the hourly meter responds to load: a firewall inspecting terabytes and a firewall inspecting nothing produce almost identical invoices. That flat profile is acceptable for the production hub it was designed for and punishing everywhere the pattern gets copied.
Traffic evidence for an expensive fixture
Discovered via Azure Resource Graph with SKU detail. Cost Management billing attributes its substantial fixed spend, and Azure Monitor metrics over a 60-day lookback show whether the firewall processes meaningful traffic. Azure Firewall cannot be stopped through a portal action ZopNight could schedule, since deallocation exists only as an API-level operation with real redeployment consequences. ZopNight treats it as a high-value review target: each firewall’s fixed cost is laid alongside two months of throughput so that an idle deployment cannot pass as infrastructure that must exist.
Hub-and-spoke copies that never should have been
The costly patterns are architectural. Dev and test VNets given their own firewall because the production template had one, multiplying a four-figure monthly fixture across environments that could share or skip it. Proof-of-concept deployments left running after the evaluation ended. And parallel firewalls surviving a hub consolidation, where spokes were repointed but the old hub’s firewall was never decommissioned. Premium-tier selection for environments that never enable its inspection features quietly compounds each of these.
Firewall inventory in the portal
Azure portal → Firewalls lists every deployment with its SKU and the VNet it sits in. For any candidate, the Metrics blade’s throughput and hit-count charts over a wide window show whether the deployment-hours are protecting real traffic.