# Per-Spoke Azure Firewall Deployments Instead of a Shared Hub Firewall Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/per-spoke-azure-firewall-deployments-instead-of-a-shared-hub-firewall Azure Firewall is designed to be deployed centrally, in a hub virtual network or a Virtual WAN secured hub, and shared by the spoke virtual networks... By: PointFive Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) The short version Azure Firewall is designed to be deployed centrally, in a hub virtual network or a Virtual WAN secured hub, and shared by the spoke virtual networks connected to that hub in the same region. PointFive Research Cloud cost research at PointFive Azure service [Azure Firewall](https://www.pointfive.co/efficiency-hub/cloud-services/azure-firewall) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0415 Type Inefficient Architecture ## Explanation Why the waste happens and who it affects. In decentralized estates, application teams or landing zone templates instead deploy a separate firewall inside each spoke or application virtual network. Every one of those firewalls carries its own fixed hourly deployment fee, so an estate with several firewalls in the same region pays the fee several times for inspection that one firewall could provide. Microsoft's Azure Firewall FAQ describes the hub-and-spoke model as the typical deployment and notes that it offers cost savings by avoiding a firewall in each virtual network, and the Well-Architected guide lists sharing the same Azure Firewall instance as a cost optimization. The saving is not free: routing spoke traffic through a hub adds virtual network peering data charges, so the consolidation case has to be evaluated against traffic volumes. ## Billing model The pricing dimensions that drive this cost. Each firewall is billed independently, so the number of deployments drives the fixed part of the bill. Deployment hour A fixed hourly fee per firewall deployment by SKU, charged regardless of scale or traffic; partial hours are billed as full hours Data processed A per-GB fee for traffic the firewall processes, which moves to the shared firewall on consolidation rather than disappearing Virtual network peering Traffic from spokes to a hub firewall crosses peering, which is billed per GB inbound and outbound at both ends, and must be weighed against the removed deployment fees Firewall policy A Firewall Manager policy with zero or one firewall association is free; a policy associated with multiple firewalls is billed at a fixed rate ## How to detect 5 checks to find it in your estate. - In Azure Resource Graph, list Microsoft.Network/azureFirewalls with location, SKU tier and the virtual network parsed from properties.ipConfigurations subnet IDs, and count firewalls per region - Flag regions with more than one firewall where the firewall virtual networks are spokes peered to a common hub, or could be - For each firewall, find route tables whose routes use the firewall's private IP as next hop to see which subnets actually depend on it and how much traffic each carries (DataProcessed metric) - Check for unexpected cross-region traffic through firewalls, which the Well-Architected guide calls out when sharing instances - In Cost Management, total the fixed deployment-hour charges of firewalls in the same region to size the saving from consolidation ## How to fix 5 ways to remove the waste. - Consolidate to one firewall per region in the hub virtual network or a Virtual WAN secured hub, and point spoke subnets at it with user-defined routes or Virtual WAN routing intent - Keep team-specific rules by using Firewall Manager policy hierarchy, with a central base policy and child policies per application, instead of separate firewalls - Model the added virtual network peering charges for spoke traffic that will now traverse the hub before decommissioning spoke firewalls - Keep one firewall per region in multi-region designs, as the Well-Architected reliability guidance recommends, rather than routing across regions to a single firewall - Deallocate and delete the spoke firewalls after cut-over, and remove their public IPs ## Documentation Vendor references for pricing and configuration. - [Architecture Best Practices for Azure Firewall - Microsoft Azure Well-Architected Framework learn.microsoft.com](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-firewall) - [Azure Firewall FAQ learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/firewall-faq) - [Pricing - Azure Firewall azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/azure-firewall/) - [FinOps best practices for Networking learn.microsoft.com](https://learn.microsoft.com/en-us/cloud-computing/finops/best-practices/networking) - [Monitoring data reference for Azure Firewall learn.microsoft.com](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall-reference) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure Firewall CER-0313 ### [Azure Firewall Premium SKU Deployed Without Using Premium Features](https://www.pointfive.co/efficiency-hub/inefficiencies/azure-firewall-premium-sku-deployed-without-using-premium-features) Azure Firewall is available in three SKUs - Basic, Standard, and Premium - each designed for different security requirements and priced accordingly. The Premium SKU includes advanced threat protection capabilities such as TLS inspection,... Networking - Azure Firewall CER-0414 ### [Non-Production Azure Firewalls Left Allocated Outside Working Hours](https://www.pointfive.co/efficiency-hub/inefficiencies/non-production-azure-firewalls-left-allocated-outside-working-hours) Azure Firewall charges a fixed hourly deployment fee for every hour a firewall is allocated, regardless of how much traffic it processes. Firewalls in development, test, lab and training environments are typically needed only during... Networking - Azure Data Factory V2 CER-0261 ### [Suboptimal Integration Runtime Region Selection in Azure Data Factory](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-integration-runtime-region-selection-in-azure-data-factory-0bcad) When Integration Runtimes use the default "Auto Resolve" region setting, the work does not always run in the region where the data lives. For copy activities, Azure makes a best effort to run in the sink data store's region (or the closest... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.