# Azure Firewall Premium SKU deployed without using premium features Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/azure-firewall-premium-sku-deployed-without-using-premium-features Azure Firewall is available in three SKUs - Basic, Standard, and Premium - each designed for different security requirements and priced accordingly. By: Aaran Bhambra Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Azure Firewall Premium SKU Deployed Without Using Premium Features The short version Azure Firewall is available in three SKUs - Basic, Standard, and Premium - each designed for different security requirements and priced accordingly. [Aaran Bhambra](https://www.linkedin.com/in/aaran-bhambra/) FinOps Engineer / DevOps Engineer @ WTW Azure service [Azure Firewall](https://www.pointfive.co/efficiency-hub/cloud-services/azure-firewall) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0313 Type Overprovisioned Resource ## Explanation Why the waste happens and who it affects. The Premium SKU includes advanced threat protection capabilities such as TLS inspection, signature-based intrusion detection and prevention (IDPS), full-path URL filtering, and URL-based web categorization (Standard also supports web categories, but matches them on FQDN only). These features are designed for highly sensitive and regulated environments, such as those processing payment card data or requiring PCI DSS compliance. However, many organizations deploy the Premium SKU by default - often during initial provisioning or as a precautionary measure - without actively configuring or requiring any of these Premium-exclusive features. The cost impact is significant because the Premium SKU carries a substantially higher fixed hourly deployment charge compared to the Standard SKU - approximately 40% more - while the per-gigabyte data processing rate remains the same across both tiers. Since this hourly charge accrues continuously regardless of whether Premium features are enabled or traffic is flowing, every firewall instance running on the Premium SKU without leveraging its advanced capabilities represents a persistent and avoidable cost premium. In organizations with multiple firewall deployments across subscriptions and environments, this waste compounds quickly. This pattern is especially common in non-production environments such as development and staging, where advanced threat protection features like TLS inspection and IDPS provide little practical value. Microsoft has recognized this as a frequent optimization opportunity and introduced a zero-downtime SKU change feature specifically to simplify the downgrade process from Premium to Standard. ## Billing model The pricing dimensions that drive this cost. Azure Firewall billing consists of two components: Fixed hourly deployment charge A per-hour fee based on the SKU tier (Basic, Standard, or Premium). This charge is incurred continuously as long as the firewall is provisioned, regardless of traffic volume. Partial hours are billed as full hours. The Premium SKU hourly rate is approximately 40% higher than the Standard SKU rate. Variable data processing charge A per-gigabyte fee for traffic processed through the firewall. This rate is the same for both Standard and Premium SKUs, meaning the data processing cost does not change based on SKU selection. All Premium-exclusive features (TLS inspection, IDPS, full-path URL filtering, URL-based web categorization) are included in the Premium hourly rate with no additional per-feature charges. This means the cost difference between Premium and Standard is entirely in the fixed hourly deployment charge - a cost that accrues whether or not those advanced features are configured or in use. Firewall policies are charged separately only when associated with more than one firewall; a policy with zero or one firewall association incurs no additional cost. For current regional pricing, see the Azure Firewall pricing page. ## How to detect 6 checks to find it in your estate. - Identify all Azure Firewall instances deployed with the Premium SKU across subscriptions and resource groups - Review the firewall policy associated with each Premium instance to determine whether Premium-exclusive features - TLS inspection, IDPS in Alert and Deny mode, or full-path URL filtering - are actively configured, and whether any web category rules rely on full-URL rather than FQDN matching - Assess whether configured Premium features are operationally required by consulting with security and compliance teams about actual threat protection needs - Evaluate whether the environment served by each Premium firewall has regulatory or compliance requirements (such as PCI DSS) that mandate the Premium SKU - Identify Premium SKU firewalls deployed in non-production environments (development, testing, staging) where advanced threat protection features are unlikely to be necessary - Review firewall deployments that were provisioned during initial setup and have not been reassessed for SKU appropriateness since deployment ## How to fix 6 ways to remove the waste. - Downgrade Premium SKU firewalls to Standard SKU where Premium-exclusive features are not configured or required - Azure supports zero-downtime SKU changes between Standard and Premium using the built-in Change SKU capability, provided the firewall uses a firewall policy (not Classic rules), runs four or fewer instances, and is in a supported region and configuration; otherwise plan a manual stop/start migration, which typically involves 20-30 minutes of downtime - Before downgrading, remove or disable all Premium-exclusive features (TLS inspection, IDPS in Alert and Deny mode, URL filtering) from the associated firewall policy, as these must be cleared before the SKU change can proceed. Web categories do not block a downgrade, but category matching becomes FQDN-only on Standard - Standardize on the Standard SKU for non-production environments where advanced threat protection provides minimal security value - Establish a periodic review process to audit firewall SKU selections against actual security requirements, ensuring Premium is only retained where its features are actively used and compliance-mandated - Implement governance policies that require justification for Premium SKU selection during new firewall provisioning to prevent unnecessary Premium deployments from being created - After downgrading, perform validation testing to confirm that firewall rules and network traffic continue to function as expected under the Standard SKU ## Documentation Vendor references for pricing and configuration. - [What is Azure Firewall? learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/overview) - [Azure Firewall features by SKU learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/features-by-sku) - [Azure Firewall Premium features implementation guide learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/premium-features) - [Choose the right Azure Firewall SKU to meet your needs learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku) - [Change Azure Firewall SKU learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/change-sku) - [Pricing - Azure Firewall azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/azure-firewall/) - [Azure Firewall performance learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/firewall-performance) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure Firewall CER-0414 ### [Non-Production Azure Firewalls Left Allocated Outside Working Hours](https://www.pointfive.co/efficiency-hub/inefficiencies/non-production-azure-firewalls-left-allocated-outside-working-hours) Azure Firewall charges a fixed hourly deployment fee for every hour a firewall is allocated, regardless of how much traffic it processes. Firewalls in development, test, lab and training environments are typically needed only during... Networking - Azure Firewall CER-0415 ### [Per-Spoke Azure Firewall Deployments Instead of a Shared Hub Firewall](https://www.pointfive.co/efficiency-hub/inefficiencies/per-spoke-azure-firewall-deployments-instead-of-a-shared-hub-firewall) Azure Firewall is designed to be deployed centrally, in a hub virtual network or a Virtual WAN secured hub, and shared by the spoke virtual networks connected to that hub in the same region. In decentralized estates, application teams or... Networking - Azure Virtual WAN CER-0300 ### [Overprovisioned Azure Virtual WAN Hub Capacity](https://www.pointfive.co/efficiency-hub/inefficiencies/overprovisioned-azure-virtual-wan-hub-capacity-a123) An Azure Virtual WAN hub is provisioned with more capacity than required to support real network traffic. Because hub costs scale with the number of configured scale units, overprovisioned hubs continue to incur higher charges even when... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.