Azure Firewall Standard costs roughly £1,100/month. Premium costs roughly £2,200. That's £1,100/month difference — £13,200/year.
For that extra spend, you get three features: TLS inspection, IDPS, and enhanced URL filtering. Three features. Thirteen thousand pounds. The question is whether you're actually getting value from them.
In our experience, the answer is usually no.
We covered the broader hub-spoke cost picture in our Azure Firewall hub-spoke post. This post focuses on the Premium versus Standard decision — one of the most common FinOps quick wins we see.
What Premium Adds
TLS Inspection
Decrypt HTTPS traffic, inspect it, re-encrypt. Powerful if your compliance requires deep packet inspection of encrypted traffic.
But TLS inspection is complex: intermediate CA setup, certificate distribution, lifecycle management, and a growing exception list for services that break when terminated mid-stream — including many of Azure's own endpoints. The configuration effort is substantial, and mistakes break things.
IDPS
Signature-based threat detection matching traffic against known threats. Genuinely useful in alert-and-deny mode for blocking known attack patterns. In alert-only mode, it generates alerts that someone needs to review, triage, and act on.
URL Filtering with Web Categories
Standard supports FQDN filtering. Premium extends to full URL path matching with web categories. For most organisations, FQDN covers the vast majority of use cases. Full path filtering is typically only necessary for specific compliance scenarios.
What We Actually See
TLS inspection is almost never enabled. The firewall was deployed as Premium, the project moved on, and nobody came back to tackle the complexity. The feature that arguably justifies most of the price tag sits unused. That's £13,200/year for a feature you're not using.
IDPS is enabled but unmonitored. Switched on — far simpler than TLS inspection — but alerts flow into a workspace nobody checks. You're generating data, not security value. Plus paying for log storage of those alerts.
URL filtering rarely needs Premium. Organisations that genuinely need full path filtering typically know it — it's a specific compliance requirement, not a nice-to-have.
The Pattern
An organisation deploys an Azure landing zone. Someone recommends Premium — who argues against better security? Premium gets deployed. The team moves on. TLS inspection goes on the backlog. IDPS runs in alert mode, alerts join everything else in Log Analytics. Nobody configures custom URL rules because FQDN works fine.
Months pass. Years pass. The firewall bills at Premium rates. Nobody revisits it because it's "infrastructure" and it's "working."
Don't Forget Firewall Basic
You might not even need Standard. Azure Firewall Basic runs at roughly £250/month — less than a quarter of Standard. It supports network rules, application rules, threat intelligence filtering, and Firewall Manager.
Basic has throughput limitations for high-traffic production hubs. But for non-production? Dev hubs? Branch connectivity? Often perfectly adequate.
If you have separate hub-spoke for production and non-production, do your dev/test hubs need Premium? Almost never. Standard is usually sufficient. Basic might be too.
Where to Start
- Check TLS inspection. Not configured? You're paying Premium for nothing.
- Review IDPS. Enabled? In what mode? Has anyone looked at an alert in the last quarter?
- Audit URL filtering rules. All FQDN-based? They'd work identically on Standard.
- Assess non-production separately. Downgrade to Standard or Basic.
- Enable what you're paying for. If you need Premium, make sure every feature is configured and operational.
- Run the numbers. Standard saves £13k/year over Premium. Basic saves £10k over Standard. Over three years, the difference between Premium and Basic is nearly £70,000.
Security and Cost Aren't Opposites
Paying for security features you're not using doesn't make you more secure. A Standard firewall with well-tuned rules, properly configured NSGs, and a team monitoring alerts is far more secure than a Premium firewall with TLS inspection dormant and IDPS alerts nobody reads.
Decide based on what you're actually using, not what you theoretically could.
Not sure where your cloud cost management stands? Take our 2-minute FinOps maturity test — 10 questions, instant results, no sign-up required.
Want a full firewall cost review? Get a free FinOps assessment — we'll check your configuration and show you what you could save.