CloudFinOpsPro
Azure waste

Azure Firewall Premium without Premium features

A firewall on the expensive tier without the expensive features
The agent tells you how to fix it
Why it happens

The higher tier is worth it for deep traffic inspection. If none of that is switched on, you are paying the premium for nothing.

Premium costs substantially more than Standard and is justified by IDPS, TLS inspection and URL filtering. Estates get built on Premium and never configure any of them.

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.network/azurefirewalls'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where properties.sku.tier =~ 'Premium'
| project name, resourceGroup, location,
          policy = tostring(properties.firewallPolicy.id)

Then read the referenced policy: if intrusionDetection is Off and there is no TLS inspection or URL filtering, Premium is buying nothing.

Applies to microsoft.network/azurefirewalls
What the agent does about it

A firewall on Premium where no Premium-only feature (IDPS, TLS inspection, URL filtering, web categories) is enabled in the attached policy.

It will not fix this one

It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.

See what it would changeAll 79 checks
Related checks

Azure Firewall that has processed no traffic

A firewall whose data processed, network rule hits and application rule hits were all zero for the whole window.

Unassociated static public IP

A reserved static address attached to nothing.

NAT gateway with no subnet

A NAT gateway associated with no subnet, billing its full hourly rate.