Skip to content

Commit eeb39c6

Browse files
committed
add info about Hierarchical policies
1 parent 12e186f commit eeb39c6

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

articles/firewall-manager/policy-overview.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,8 @@ Azure Firewall supports Basic, Standard, and Premium policies. The following tab
5353

5454
New policies can be created from scratch or inherited from existing policies. Inheritance allows DevOps to create local firewall policies on top of organization mandated base policy.
5555

56-
Policies created with non-empty parent policies inherit all rule collections from the parent policy.
56+
Policies created with non-empty parent policies inherit all rule collections from the parent policy. The parent policy and the child policy must be in the same region. A firewall policy can be associated with firewalls across regions regardless where they are stored.
57+
5758
Network rule collections inherited from a parent policy are always prioritized over network rule collections defined as part of a new policy. The same logic also applies to application rule collections. However, network rule collections are always processed before application rule collections regardless of inheritance.
5859

5960
Threat Intelligence mode is also inherited from the parent policy. You can set your threat Intelligence mode to a different value to override this behavior, but you can't turn it off. It's only possible to override with a stricter value. For example, if your parent policy is set to **Alert only**, you can configure this local policy to **Alert and deny**.

0 commit comments

Comments
 (0)