Azure Firewall Basic vs Standard vs Premium
Verdict: Basic for SMB up to around 250 Mbps; Standard to 30 Gbps with threat intel and DNS proxy; Premium to 100 Gbps with outbound TLS termination and IDPS; inbound TLS termination needs Application Gateway alongside Premium.
| Criterion | Azure Firewall Basic | Azure Firewall Standard | Azure Firewall Premium |
|---|---|---|---|
| Throughput ceiling | Fixed scale unit, ~250 Mbps | Autoscales to 30 Gbps | Autoscales to 100 Gbps |
| TLS inspection | None | None | Outbound TLS termination |
| IDPS | None | None | Signature-based, fully managed |
| Threat intel and DNS proxy | Alerts on threat intel matches only | Threat intel filtering plus DNS proxy | Threat intel filtering plus DNS proxy |
| Target workload | SMB, single small VNet | General enterprise, multi-VNet hub | Highly sensitive, compliance-driven workloads |
| Inbound TLS termination | Not supported | Not supported | Via Application Gateway alongside Premium, not native |
| Choose when | Budget-constrained SMB at ~250 Mbps, no advanced threat protection needed | Up to 30 Gbps with threat intel and DNS proxy, no TLS inspection required | Compliance needs outbound TLS inspection and IDPS, or throughput exceeds 30 Gbps |
Rules
- Choose Basic for SMB workloads at around 250 Mbps with no requirement for advanced threat protection.
- Choose Premium when compliance requires outbound TLS termination and signature-based IDPS; only Premium offers both.
- Premium autoscales to 100 Gbps, Standard to 30 Gbps, Basic to roughly 250 Mbps.
- Inbound TLS termination is achieved by deploying Application Gateway alongside Firewall Premium, not natively on any Firewall SKU.
- Azure Firewall Manager centrally authors and associates WAF policies for both Front Door and Application Gateway.
- Partner SECaaS provider integration for branch and VNet internet traffic requires a secured virtual hub deployment.
Traps
- Standard has no TLS termination capability of any kind; a DNAT rule translates ports but never decrypts traffic.
- Basic only alerts on threat intelligence matches - it has no TLS inspection or intrusion detection capability.
- Azure Firewall autoscales natively within a SKU; manually load balancing two Standard instances is not the documented scaling path to reach Premium-level throughput.
- WAF protects HTTP/HTTPS applications from web exploits; it is not a general network firewall substitute for any Firewall SKU.