# Azure Firewall Idle

> Azure Firewall costs roughly $900+ per month at a flat hourly rate, so ZopNight checks three 30-day series (DataProcessed under 1 MB, NetworkRuleHit under 1, ApplicationRuleHit under 1) and flags the firewall only when all three are silent. A perimeter appliance gets the most abstain-biased treatment in the ruleset.

Source: https://zop.dev/integrations/azure/recommendations/azure-firewall-idle
Updated: 2026-08-19

---

## A $900 appliance deserves three locks

Azure Firewall is both expensive and dangerous to remove: the SKU bills a flat hourly rate
(roughly $900+ a month before data charges) and a wrong delete tears down a network perimeter.
ZopNight treats it accordingly. Before the finding fires, three independent Azure Monitor axes must all be quiet:
`DataProcessed` for bytes flowing through, `NetworkRuleHit` for L4 rule matches, and
`ApplicationRuleHit` for L7 FQDN/HTTP filtering. Partial evidence is
never enough; a missing series on any axis means abstain, not fire.

## Floors tuned to platform noise

A firewall in a live perimeter emits a tiny baseline with no real workload: keepalives, health
probes, DNS-proxy housekeeping. The floors are sized to admit only that baseline:
1,000,000 bytes (1 MB) averaged on the data axis, single-digit counts (floor of 1) on each
rule-hit axis. Real perimeter traffic runs megabytes per second and thousands of hits, so
anything at or above a floor, including one Maximum spike, vetoes the finding.

## Thirty days on every axis, not seven

Cheaper idle rules accept a 7-day history floor. This one demands the full 30 days of coverage
on all three series, because a freshly deployed firewall showing zeros proves only that
monitoring just started. The blast radius of a false positive justifies the longer wait.

## Verify all three axes at once

```bash
az monitor metrics list \
  --resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/azureFirewalls/<name>" \
  --metric DataProcessed NetworkRuleHit ApplicationRuleHit \
  --interval PT1H --offset 30d --aggregation Average Maximum
```

## Scheduling instead of deleting

For a dev/test perimeter, the cheaper-than-delete option is deallocating the firewall
off-hours. Azure Firewall Manager is a policy service and does not offer start/stop
scheduling, so the working pattern is an Automation runbook calling the PowerShell
`Deallocate()` and `Allocate()` methods on the firewall object.

## The abstain list

No fire when any of the three series is absent, any axis has under 30 days of data, any axis
reads at or above its floor, or the SKU cost is unpriced. Detection needs Reader plus
Monitoring Reader; nothing in ZopNight holds a write permission on Azure Firewall.