Separate Firewall Policy edit availability from continued firewall operation

Source facts

An Azure Firewall Policy can be created in one region and associated globally with multiple firewall instances under the same Entra tenant. If its home region fails and has a paired region, the Resource Manager object metadata automatically fails over.

During that failover, or while an unpaired home region remains failed, the policy object cannot be modified. Microsoft states that linked firewall instances continue operating. Microsoft Learn.

Applicability

Identify the policy’s home region, paired-region context and associated firewalls. Distinguish the ability to submit an emergency rule change from the behavior of already configured traffic paths.

DSE recommendation

DSE recommends maintaining separate incident observations for policy management and traffic enforcement. Record which proposed changes are blocked and which application paths are actually affected. Route emergency decisions through the incident owner rather than interpreting an editing failure as permission to bypass the firewall. Keep the last approved configuration available for comparison without assuming it establishes current application health.

Verification

During an incident or approved exercise, compare management-operation results with authorized permitted and denied traffic tests. Preserve their timestamps and scopes independently. After policy management recovers, reconcile queued changes with the current configuration before applying them. Do not claim that continued firewall operation guarantees every dependency or application remained available.

Official references

Microsoft Learn: Azure Firewall Manager policy overview. Source retrieved September 9, 2026.