Reassess web-category matching when downgrading Azure Firewall to Standard

Source facts

Microsoft’s Firewall SKU-change guide says web categories are available in both Standard and Premium and do not themselves block a downgrade. It distinguishes their matching: Premium uses the complete URL for HTTP and HTTPS category matching, while Standard categorizes by fully qualified domain name. The guide describes the downgrade as reducing that granularity. Microsoft Learn.

Applicability

Use this review for a proposed Premium-to-Standard change involving web-category controls. Identify the applications and category decisions the organization relies on. Keep this question separate from other Premium features that require their own removal or migration review.

DSE recommendation

DSE recommends asking the security owner whether domain-level classification meets the original control requirement. Select representative permitted and denied application paths before the change. Record any requirement that depends on more detailed matching, and resolve it explicitly rather than assuming that a retained rule name preserves the prior behavior. Use a scheduled, reversible pilot with the complete source’s prerequisites.

Verification

In an approved test environment, compare the relevant request outcomes and logged category decisions under the intended Standard configuration. Include multiple relevant paths on the same host where appropriate. Preserve observed differences and the owner’s acceptance decision. A successful SKU change should not close an unverified category-enforcement requirement.

Official references

Microsoft Learn: Change Azure Firewall SKU.