Question

Contoso manages security for multiple Azure Firewall instances using Azure Firewall Manager. The security team creates a parent firewall policy named 'Corp-Base' that contains rule collection groups blocking known malicious FQDNs and enforcing threat intelligence. Regional teams need their own policies that add region-specific application rules but must not be able to remove or override the corporate blocking rules. You need to design the policy structure so that regional policies automatically include all Corp-Base rules while allowing regional additions. What should you do?

Accepted Answer

Create each regional policy as a child policy that inherits from Corp-Base, then add region-specific rule collection groups to the child policy.

Answer

Copy the Corp-Base rule collection groups into each regional policy manually and add the region-specific rules alongside them.

Answer

Associate Corp-Base and each regional policy to the same firewall, letting Firewall Manager merge the rules automatically.

Answer

Create the regional policies as standalone policies and use an Azure Policy definition to enforce that they contain the Corp-Base rules.