Microsoft.Network firewallPolicies 2020-05-01

The firewallPolicies resource type can be deployed to: Resource groups.

To learn about resource group deployments, see Bicep or ARM template.

Template format

To create a Microsoft.Network/firewallPolicies resource, add the following Bicep or JSON to your template.

resource symbolicname 'Microsoft.Network/firewallPolicies@2020-05-01' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  properties: {
    basePolicy: {
      id: 'string'
    dnsSettings: {
      enableProxy: bool
      requireProxyForNetworkRules: bool
      servers: [ 'string' ]
    threatIntelMode: 'string'
    threatIntelWhitelist: {
      fqdns: [ 'string' ]
      ipAddresses: [ 'string' ]

Property values


Name Description Value
type The resource type

For Bicep, set this value in the resource declaration.
apiVersion The resource api version

For Bicep, set this value in the resource declaration.
name The resource name string (required)
location Resource location. string
tags Resource tags. Dictionary of tag names and values. See Tags in templates
properties Firewall Policy definition. FirewallPolicyPropertiesFormat


Name Description Value
basePolicy Reference to another subresource. SubResource
dnsSettings DNS Proxy Settings in Firewall Policy. DnsSettings
threatIntelMode The operation mode for Threat Intel. 'Alert'
threatIntelWhitelist ThreatIntel Allowlist for Firewall Policy. FirewallPolicyThreatIntelWhitelist


Name Description Value
id Resource ID. string


Name Description Value
enableProxy Enable DNS Proxy on Firewalls attached to the Firewall Policy. bool
requireProxyForNetworkRules FQDNs in Network Rules are supported when set to true. bool
servers List of Custom DNS Servers. string[]


Name Description Value
fqdns List of FQDNs for the ThreatIntel Allowlist. string[]
ipAddresses List of IP addresses for the ThreatIntel Allowlist. string[]

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Use Azure Firewall as a DNS Proxy in a Hub & Spoke topology

Deploy to Azure
This sample show how to deploy a hub-spoke topology in Azure using the Azure Firewall. The hub virtual network acts as a central point of connectivity to many spoke virtual networks that are connected to hub virtual network via virtual network peering.
Create a Firewall and FirewallPolicy with Rules and Ipgroups

Deploy to Azure
This template deploys an Azure Firewall with Firewall Policy (including multiple application and network rules) referencing IP Groups in application and network rules.
Create a Firewall with FirewallPolicy and IpGroups

Deploy to Azure
This template creates an Azure Firewall with FirewalllPolicy referencing Network Rules with IpGroups. Also, includes a Linux Jumpbox vm setup
Testing environment for Azure Firewall Premium

Deploy to Azure
This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
Create a sandbox setup with Firewall Policy

Deploy to Azure
This template creates a virtual network with 3 subnets (server subnet, jumpbox subet and AzureFirewall subnet), a jumpbox VM with public IP, A server VM, UDR route to point to Azure Firewall for the Server Subnet and an Azure Firewall with 1 or more Public IP addresses. Also creates a Firewall policy with 1 sample application rule, 1 sample network rule and default private ranges
Secured virtual hubs

Deploy to Azure
This template creates a secured virtual hub using Azure Firewall to secure your cloud network traffic destined to the Internet.