Azure firewall application rule doesn't work

Hello @Van Huy Tuyen,

Thank you for reaching out on Microsoft Q&A forum.

I understand your question regarding the issue where your Azure Firewall application rule for Google is not appearing in diagnostic logs.

So basically, Azure Firewall processes rules in a fixed order by rule type, not by numeric priority across types:

1. DNAT rules
2. Network rules
3. Application rules

Reference: https://learn.microsoft.com/en-us/azure/firewall/rule-processing

Even if your application rule has a lower numeric priority (e.g., 11003), network rules always take precedence. In your case:

• Network rule allowing full HTTPS (priority 50002) matches first.
• Therefore, traffic to Google is processed by the network rule, and the application rule is never evaluated.

This is expected behaviour per Azure Firewall design.

Logs reflect the rule that processed the traffic. Since the network rule matched first, diagnostic logs show hits for the network rule only.

To ensure Google traffic matches the Application rule:

1.Restrict the Network Rule:

• Modify the Network rule in Group 2 to exclude Google destinations (e.g., limit to specific IP ranges or exclude Google’s resolved IPs).
• Alternatively, add a higher-priority Network rule to deny Google IPs, forcing traffic to fall through to Application rules.
• Note: Network rules use IPs, not FQDNs, unless you’re using Azure Firewall Premium with FQDN filtering in Network rules.

2.Remove Broad HTTPS Rule:

• If the allow-all-HTTPS rule isn’t critical, remove or disable it to let Application rules handle Google traffic.

3.Verify Diagnostic Settings:

• In the Azure portal, go to Firewall → Diagnostic settings → Ensure both AzureFirewallNetworkRule and AzureFirewallApplicationRule categories are enabled and sent to your Log Analytics workspace.

If the above information is helpful kindly upvote it. If you have extra questions about this answer, please click "Comment".

Hi @Thanmayi Godithi

I remove allow-all-HTTPS rule, but application rule still doesn't work. Please help to check.

Thanks!