IDPS Inspection is Enabled in Deny Mode on Azure Firewall

Overview

Azure Firewall Premium provides signature-based intrusion detection and prevention (IDPS) that identifies attacks by detecting specific patterns in network traffic, such as byte sequences and known malicious instruction sequences used by malware. IDPS applies to inbound, east-west (spoke-to-spoke), and outbound traffic across Layers 3-7. When IDPS isn’t configured in Alert and deny mode, Azure Firewall only logs detected threats without blocking them.

Without IDPS enabled in Alert and deny mode:

• Threat actors can send traffic that matches known attack signatures without being blocked.
• Organizations running IDPS in Alert only mode gain visibility into threats but can’t prevent intrusion attempts from reaching their workloads.
• Lateral movement and exfiltration traffic that matches known attack signatures passes through the firewall without active intervention.

Remediation

• Enable IDPS in Alert and Deny mode in Azure Firewall Premium by configuring the intrusion detection mode to Alert and deny in the firewall policy.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1190 Exploit Public-Facing Application, T1210 Exploitation of Remote Services, T1071 Application Layer Protocol
Licence	Azure_Firewall_Premium
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.