Intune Firewall Default Outbound Block Cuts Connectivity Before Firewall Rules Apply

I am deploying two Intune Firewall policies:

1. A Firewall Configuration policy
2. A Firewall Rules policy

In the Firewall Configuration policy, I have configured the Default Outbound Action as Block, with the intention of allowing only the required outbound traffic through explicit firewall rules.

However, I have observed what appears to be a race condition between the two policies. The Firewall Configuration policy is applied first, which immediately blocks all outbound network traffic. Since internet connectivity is cut off before the Firewall Rules policy is delivered and applied, the device is unable to receive the required firewall rules, resulting in a broken state.

My questions are:

• Why does Intune process these policies in this manner?
• If configuring Default Outbound Action = Block can prevent the corresponding allow rules from being delivered, what is the intended use case for this setting?
• Is there any mechanism within Intune to ensure that firewall rules are applied before or together with the firewall configuration policy?

My goal is to maintain a default outbound block posture and explicitly allow required traffic through firewall rules, rather than leaving outbound traffic allowed by default and blocking only specific destinations. I am looking for guidance or best practices on how to implement this approach reliably through Intune without causing devices to lose connectivity. I am deploying two Intune Firewall policies:

1. A Firewall Configuration policy
2. A Firewall Rules policy

In the Firewall Configuration policy, I have configured the Default Outbound Action as Block, with the intention of allowing only the required outbound traffic through explicit firewall rules.

However, I have observed what appears to be a race condition between the two policies. The Firewall Configuration policy is applied first, which immediately blocks all outbound network traffic. Since internet connectivity is cut off before the Firewall Rules policy is delivered and applied, the device is unable to receive the required firewall rules, resulting in a broken state.

My questions are:

• Why does Intune process these policies in this manner?
• If configuring Default Outbound Action = Block can prevent the corresponding allow rules from being delivered, what is the intended use case for this setting?
• Is there any mechanism within Intune to ensure that firewall rules are applied before or together with the firewall configuration policy?

My goal is to maintain a default outbound block posture and explicitly allow required traffic through firewall rules, rather than leaving outbound traffic allowed by default and blocking only specific destinations. I am looking for guidance or best practices on how to implement this approach reliably through Intune without causing devices to lose connectivity.