# Azure Firewall explicit proxy reaches GA

> Selected applications and browsers can send HTTP and HTTPS egress to Azure Firewall through standard proxy settings without rerouting a whole subnet.

Canonical URL: https://www.devobs.io/news/news-azure-firewall-explicit-proxy-ga/
By: Theo Morgan
Published: 2026-09-06T11:58:54.639Z
Updated: 2026-09-06T11:58:54.639Z
Event date: 2026-09-02
Section: Security

Explicit proxy support in Azure Firewall became generally available on September 2. The [Azure Networking announcement](https://techcommunity.microsoft.com/blog/azurenetworkingblog/azure-firewall-explicit-proxy-is-now-generally-available/4552450) says applications and browsers can send outbound HTTP and HTTPS traffic to the firewall's private IP and proxy port through standard proxy configuration. Other traffic in the subnet can keep its existing route.

## Egress steering can be selective

Route-based designs often send every flow from a subnet through a firewall. Explicit proxy lets platform teams onboard chosen HTTP clients without changing all subnet routing at once. Central policy and logs can then cover those clients while unrelated protocols follow their current path.

The model depends on client configuration. Software that ignores system proxy settings, uses unsupported protocols, or connects directly can bypass this path unless separate network controls prevent it. TLS inspection, destination policy, and application compatibility also need their own decisions.

## Test clients and bypass paths

Inventory how each application discovers proxy settings: static configuration, environment variables, operating-system settings, or a PAC file. Test HTTP, HTTPS, redirects, authentication, certificate validation, large transfers, and failure when the proxy is unavailable. Confirm which source identity and destination appear in firewall logs.

Use network controls to match the intended enforcement claim. If policy requires all web egress through inspection, block direct alternatives and monitor denied attempts. If adoption is optional, document which clients remain outside the proxy.

Roll out to a small application group and measure connection reuse, latency, timeout behavior, and firewall capacity. Keep an emergency configuration rollback, but avoid silently falling back to direct internet access when that would violate policy. GA provides a supported proxy mode; enforcement still depends on closing ungoverned routes and maintaining accurate client configuration.

## Source references

- <https://techcommunity.microsoft.com/blog/azurenetworkingblog/azure-firewall-explicit-proxy-is-now-generally-available/4552450>