Azure Firewall pricing — and how to cut it.

Azure Firewall bills two ways: a per-deployment-hour fee plus a per-GB data-processing charge on all traffic it handles. On the Standard SKU that is $1.25 per deployment-hour — roughly $913/month before a single byte — plus $0.016 per GB. The Premium SKU is $1.75 per deployment-hour (around $1278/month floor) plus the same $0.016 per GB. The Basic SKU is $0.395 per hour plus $0.065 per GB (us-based list, dated 2026-07-04, directional). The hourly floor is fixed regardless of scale, and the per-GB line grows with your traffic.

Three SKUs at three price points. Basic is $0.395/hour plus $0.065/GB, aimed at small environments. Standard is $1.25/hour plus $0.016/GB — around $912/month before any traffic. Premium is $1.75/hour plus $0.016/GB — around $1,278/month floor — and adds TLS inspection and IDPS. A common mistake is to quote $1.25/hour with $0.065/GB together; that mixes two SKUs. The $0.065/GB rate belongs to Basic only; Standard and Premium are $0.016/GB (dated 2026-07-04, directional).

The cost is dominated by the fixed per-deployment-hour fee. On Standard, $1.25/hour is roughly $913/month whether you push one gigabyte or a terabyte — a high floor for a single firewall. Premium raises that floor to about $1278/month. The per-GB data-processing charge then adds on top and scales with egress. For a workload that runs continuously, the fixed hourly floor is usually the bigger surprise.

To use Azure Firewall Premium's deep L7 inspection (TLS inspection and IDPS) you must terminate and decrypt TLS at the firewall, which means giving the firewall custody of the keys and managing a certificate chain. Enforza filters on SNI/FQDN without terminating TLS — you get identity-aware L7 egress control without breaking encryption or taking on key custody.

Replace the metered SKU with a flat-priced firewall NVA. Enforza is a single Linux VM in your own Azure network that does the same egress, ingress and east-west control — identity-aware L7 (SNI/FQDN) filtering, secure source-NAT and threat hardening — under a flat per-firewall licence at $0/GB, with no per-hour deployment floor. You pay only the Azure VM plus the flat Enforza licence, so the bill stops scaling with traffic. Migration is a route-table (UDR) change.

Yes. Enforza covers the roughly 98% of firewalling most organisations actually use — egress, ingress and east-west control, identity-aware L7/FQDN filtering without breaking TLS, secure NAT and compliance — as one flat-priced appliance, with no per-GB tax and no per-hour SKU floor. It is not a six-figure enterprise platform and does not try to be; it is the drop-in replacement for the cloud-native firewall at up to 60–80% less. See the full side-by-side on the Enforza vs Azure Firewall comparison.

Enforza is a flat per-firewall licence — £179/month per firewall, dropping to £149 from your sixth — at $0/GB, plus the Azure VM you run it on. Against Azure Firewall Standard (a ~$913/month hourly floor plus $0.016/GB) or Premium (a ~$1278/month floor), the flat line typically lands 60–80% cheaper, and the gap widens with traffic because the Enforza line stays flat while the metered SKU climbs. Rates are directional and dated — run your own numbers in the savings calculator.

No. Enforza removes the per-GB data-processing tax and the per-deployment-hour SKU fee, and replaces them with one flat per-firewall licence. You still pay Azure for the VM the firewall runs on (typically $100–$200/month at modest egress) and for normal data-transfer-out where it applies. The saving is on the firewall metering, not on Azure's underlying infrastructure.