Azure Firewall Explicit Proxy GA Delivers Granular Egress Steering Without Subnet Rearchitecture

Microsoft announced the general availability of native explicit proxy support in Azure Firewall. This capability allows applications, virtual machines, and browsers to direct outbound HTTP and HTTPS traffic straight to Azure Firewall using standard explicit proxy settings or Proxy Auto-Configuration (PAC) files stored securely in Azure Blob Storage. Rather than intercepting traffic transparently through routing tables, Azure Firewall acts as an explicit forward proxy endpoint listening on a designated port, evaluating traffic against centralized application rules and threat intelligence before forwarding requests to external destinations. For cloud architects and network engineers, this release removes a longstanding architectural friction point in cloud egress management. Previously, inspecting outbound web traffic in Azure required implementing User-Defined Routes (UDRs) across subnets, steering 100% of subnet traffic into a firewall regardless of whether every workload required inspection. This all-or-nothing approach introduced route table sprawl, risked breaking non-HTTP services, and complicated migration for enterprise workloads that historically depended on explicit forward proxies. With explicit proxy support, teams can target inspection specifically to designated applications, browsers, and Azure Arc-enabled hybrid hosts while leaving baseline subnet routing undisturbed. This development reflects a decisive, industry-wide shift across public cloud platforms to absorb specialized network appliance capabilities directly into native, software-defined infrastructure. As enterprises pursue zero-trust architectures, inspecting and governing outbound traffic has become mandatory to prevent data exfiltration, command-and-control communication, and unvetted SaaS access. By folding native forward proxying into Azure Firewall, Microsoft is eliminating the need for organizations to maintain separate third-party network virtual appliances (NVAs) for proxying, aligning with similar convergence efforts across modern cloud networking fabrics. In practice, platform teams should begin evaluating legacy forward-proxy virtual appliances for consolidation into Azure Firewall to reduce licensing and management overhead. Implementation involves enabling explicit proxy within the Azure Firewall Policy, designating an HTTP/HTTPS proxy port, and hosting PAC files in Azure Blob Storage with managed identity authentication. Teams must note that explicit proxy requires explicit configuration on the client workload side—either via environment variables, group policies, or browser settings—meaning it complements, rather than completely replaces, transparent UDR-based steering for workloads where client-side proxy configurations cannot be injected.