# Azure Firewall

> Azure Firewall bills per deployment-hour plus data processed, starting at roughly $900 a month for the Standard SKU before a single packet flows. ZopNight attributes that fixed spend from Cost Management and checks 60 days of Azure Monitor metrics to show whether each firewall actually processes meaningful traffic.

Source: https://zop.dev/integrations/azure/azure-firewall
Updated: 2026-08-19

---

Azure Firewall is a managed, stateful network firewall billed per deployment-hour plus data processed, starting at roughly $900 per month for Standard. A firewall protecting an empty dev VNet is a very expensive placeholder.

## Deployment-hours dominate the firewall bill

The meter has two parts: a fixed charge for every hour the firewall is deployed, and a smaller per-GB charge for data it processes. For most deployments the hourly component is nearly the whole bill. Standard runs to roughly $900 a month deployed; Premium, with TLS inspection and IDPS, costs materially more. Nothing about the hourly meter responds to load: a firewall inspecting terabytes and a firewall inspecting nothing produce almost identical invoices. That flat profile is acceptable for the production hub it was designed for and punishing everywhere the pattern gets copied.

## Traffic evidence for an expensive fixture

Discovered via Azure Resource Graph with SKU detail. Cost Management billing attributes its substantial fixed spend, and Azure Monitor metrics over a 60-day lookback show whether the firewall processes meaningful traffic. Azure Firewall cannot be stopped through a portal action ZopNight could schedule, since deallocation exists only as an API-level operation with real redeployment consequences. ZopNight treats it as a high-value review target: each firewall's fixed cost is laid alongside two months of throughput so that an idle deployment cannot pass as infrastructure that must exist.

## Hub-and-spoke copies that never should have been

The costly patterns are architectural. Dev and test VNets given their own firewall because the production template had one, multiplying a four-figure monthly fixture across environments that could share or skip it. Proof-of-concept deployments left running after the evaluation ended. And parallel firewalls surviving a hub consolidation, where spokes were repointed but the old hub's firewall was never decommissioned. Premium-tier selection for environments that never enable its inspection features quietly compounds each of these.

## Firewall inventory in the portal

Azure portal → Firewalls lists every deployment with its SKU and the VNet it sits in. For any candidate, the Metrics blade's throughput and hit-count charts over a wide window show whether the deployment-hours are protecting real traffic.