Alternatives for URL / Path‑based Whitelisting When Azure Firewall Supports Only FQDN Filtering

Ashish Bang hello & thx for join me here at Q&A portal,

yeah the clean answer is Azure Firewall Standard wont do URL/path allowlisting, only FQDN/app rules, so if security needs host + path control then u need Azure Firewall Premium with TLS inspection + URL filtering, because Premium URL filtering extends FQDN filtering to the full URL including path.

Azure Firewall app rules use FQDN/SNI for HTTP/S, and network FQDN rules resolve names to IPs, so neither gives real path-level control by itself. for production, the normal pattern is: route egress through Azure Firewall Premium, enable TLS inspection, install/trust the firewall CA on workloads, then create URL filtering rules for the exact Google Maps/KML paths u need. If TLS inspection is not allowed, Azure Firewall cannot reliably see HTTPS paths, because the path is inside encrypted HTTP.

In that case ur options are basically use a proxy/SWG that supports URL allowlists, put an app-level egress proxy/broker that fetches only approved URLs or accept FQDN-level allowlisting and reduce risk with logging, threat intel, IDPS, and tight managed identity/SAS controls where applicable.

If u use FQDN rules, enable DNS proxy so firewall and clients resolve the same names, otherwise dynamic Google endpoints can behave weirdly. tl dr: for Azure-native path filtering use Azure Firewall Premium URL filtering + TLS inspection; without TLS inspection, path-level HTTPS filtering is not technically possible, only domain-level contro

rgds, Alex

&

pls if my answer helps pls accept it.

Hi Ashish Bang,

Thanks for reaching out in Microsoft Q&A forum,

Given that Azure Firewall only supports FQDN‑based rules, what Azure‑supported design patterns are recommended for more granular outbound control (closer to URL/path‑level filtering)?

According to Microsoft’s official Azure Firewall Premium features documentation, the solution for your need to whitelist outbound URLs at the path level (like specific Google Maps endpoints) is to upgrade to Azure Firewall Premium and enable URL filtering with TLS inspection.

Azure Firewall Standard only supports FQDN-based rules, which forces you to whitelist entire domains. Premium extends this capability to evaluate the full URL path, so you can allow maps.googleapis.com/maps/api/staticmap/* instead of opening the entire googleapis.com domain.

For HTTPS traffic (which Google Maps and most third-party APIs use), you must enable TLS inspection at the application rule level. Azure Firewall Premium decrypts the traffic, extracts the URL, validates it against your whitelist rules, and then re-encrypts it before forwarding it to the internet. This feature is generally available (GA), not in preview, and is production-grade with a 99.99% SLA and PCI compliance, making it safe for enterprise workloads.

Key points about this solution:

URL filtering works for both HTTP and HTTPS traffic when TLS inspection is enabled

You whitelist specific paths instead of entire domains, significantly reducing your attack surface

• Your application requires no code changes it continues calling the same URLs as before
• Azure Firewall remains your centralized egress control point, maintaining your current architecture
• This is the only Microsoft-native, GA solution that supports URL/path-level outbound filtering

Important operational consideration:

TLS inspection requires deploying Azure Firewall’s CA certificate to all clients making outbound HTTPS calls. This includes VMs, containers, AKS nodes, build agents, and any automation runtimes. While this is a one-time PKI task, it is the main setup effort Microsoft documents. Without this certificate deployed, HTTPS traffic to your whitelisted URLs will fail.

Other options like Azure Maps with Private Endpoints are not suitable for your immediate needs since Google Maps does not support Private Link, and migrating to Azure Maps would require application code changes.

Azure Firewall Premium SKU already supports URL/path-level filtering for outbound traffic. The limitation you discovered (only FQDN-based filtering) applies to Azure Firewall Standard, not Premium. Your current setup can whitelist fine-grained URLs like maps.google.com/mapfiles/kml without opening the entire domain.

What you need to configure correctly:

Create an Application Rule (never use Network Rules for URL paths)

Enable TLS inspection on that Application Rule (required for HTTPS URL filtering)

Set Destination Type = URL (not FQDN)

In the Destination field, enter the full path without http:// or https://, for example: maps.google.com/mapfiles/kml or *.google.com/mapfiles/kml*

Once configured this way, Azure Firewall Premium will evaluate the entire URL including the path, not just the domain name.

Official Microsoft documentation:

• Azure Firewall Premium features (URL filtering + TLS inspection): https://learn.microsoft.com/en-us/azure/firewall/premium-features
• Deploy and configure Azure Firewall Premium: https://learn.microsoft.com/en-us/azure/firewall/premium-deploy
• Azure Firewall features by SKU (confirms URL filtering is Premium-only): https://learn.microsoft.com/en-us/azure/firewall/features-by-sku

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.