# Reassess web-category matching when downgrading Azure Firewall to Standard

> Category support remains, but the documented matching detail changes.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-142-reassess-web-category-matching-when-downgrading-azure-firewall-to-standard/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:38+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Category support remains, but the documented matching detail changes.

## Potentially affected

Use this review for a proposed Premium-to-Standard change involving web-category controls. Identify the applications and category decisions the organization relies on. Keep this question separate from other Premium features that require their own removal or migration review.

## DSE recommendation

DSE recommends asking the security owner whether domain-level classification meets the original control requirement.

## Article

## Source facts

Microsoft’s Firewall SKU-change guide says web categories are available in both Standard and Premium and do not themselves block a downgrade. It distinguishes their matching: Premium uses the complete URL for HTTP and HTTPS category matching, while Standard categorizes by fully qualified domain name. The guide describes the downgrade as reducing that granularity. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall/change-sku).

## Applicability

Use this review for a proposed Premium-to-Standard change involving web-category controls. Identify the applications and category decisions the organization relies on. Keep this question separate from other Premium features that require their own removal or migration review.

## DSE recommendation

DSE recommends asking the security owner whether domain-level classification meets the original control requirement. Select representative permitted and denied application paths before the change. Record any requirement that depends on more detailed matching, and resolve it explicitly rather than assuming that a retained rule name preserves the prior behavior. Use a scheduled, reversible pilot with the complete source’s prerequisites.

## Verification

In an approved test environment, compare the relevant request outcomes and logged category decisions under the intended Standard configuration. Include multiple relevant paths on the same host where appropriate. Preserve observed differences and the owner’s acceptance decision. A successful SKU change should not close an unverified category-enforcement requirement.

## Official references

[Microsoft Learn: Change Azure Firewall SKU](https://learn.microsoft.com/en-us/azure/firewall/change-sku).

## Primary reference

- Name: Change Azure Firewall SKU | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/firewall/change-sku
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Reassess web-category matching when downgrading Azure Firewall to Standard,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-142-reassess-web-category-matching-when-downgrading-azure-firewall-to-standard/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.