# IDPS Inspection is Enabled in Deny Mode on Azure Firewall
Azure Firewall Premium provides signature-based intrusion detection and prevention (IDPS) that identifies attacks by detecting specific patterns in…
Source: https://maester.dev/docs/tests/ZTA.25539
## Overview
Azure Firewall Premium provides signature-based intrusion detection and prevention (IDPS) that identifies attacks by detecting specific patterns in network traffic, such as byte sequences and known malicious instruction sequences used by malware. IDPS applies to inbound, east-west (spoke-to-spoke), and outbound traffic across Layers 3-7. When IDPS isn't configured in `Alert and deny` mode, Azure Firewall only logs detected threats without blocking them.
Without IDPS enabled in `Alert and deny` mode:
- Threat actors can send traffic that matches known attack signatures without being blocked.
- Organizations running IDPS in `Alert only` mode gain visibility into threats but can't prevent intrusion attempts from reaching their workloads.
- Lateral movement and exfiltration traffic that matches known attack signatures passes through the firewall without active intervention.
## Remediation
- [Enable IDPS in Alert and Deny mode in Azure Firewall Premium](https://learn.microsoft.com/azure/firewall/premium-features?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) by configuring the intrusion detection mode to `Alert and deny` in the firewall policy.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Infrastructure hardening |
| ATT&CK | [T1190](/docs/tests?mitre=T1190) Exploit Public-Facing Application, [T1210](/docs/tests?mitre=T1210) Exploitation of Remote Services, [T1071](/docs/tests?mitre=T1071) Application Layer Protocol |
| Licence | Azure_Firewall_Premium |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.