author: HULKsmashGithub
ms.service: entra-id
ms.topic: include
ms.date: 02/24/2026
manager: dougeby
ms.custom: Network-Secure-Recommendation
# minimumlicense: Azure Firewall Standard
# sfipillar: Protect networks
# category: Azure Network Security
# risklevel: High
# userimpact: Low
# implementationcost: Low
---
Azure Firewall threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When threat intelligence isn't enabled in Alert and Deny mode, Azure Firewall doesn't actively block traffic to known malicious destinations.
Without threat intelligence enabled in Deny mode:
- Threat actors can communicate with known malicious infrastructure, enabling data exfiltration and command-and-control communication without active blocking.
- Organizations that use Alert-only mode can see threat activity in logs but can't prevent connections to known bad destinations.
- All firewall policy tiers remain exposed to threats that the Microsoft Threat Intelligence feed has already identified.
author: HULKsmashGithub
ms.service: entra-id
ms.topic: include
ms.date: 02/25/2026
manager: dougeby
ms.custom: Network-Secure-Recommendation
# minimumlicense: Azure Firewall Premium
# sfipillar: Protect networks
# category: Azure Network Security
# risklevel: High
# userimpact: Low
# implementationcost: Low
---
Azure Firewall threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When you don't enable threat intelligence in `Alert and deny` mode, Azure Firewall doesn't actively block traffic to known malicious destinations.
If you don't enable threat intelligence in `Alert and deny` mode:
- Threat actors can communicate with known malicious infrastructure, enabling data exfiltration and command-and-control communication without active blocking.
- Organizations that use `Alert only` mode can see threat activity in logs but can't prevent connections to known bad destinations.
- All firewall policy tiers remain exposed to threats that the Microsoft Threat Intelligence feed already identified.