Exempt management layer VNETs from 'All Internet traffic should be routed via your deployed Azure Firewall' policy

Context and Problem Statement

Our landing zone implementation adheres to the Azure Security Benchmark but the Azure Policy that validates whether all internet traffic is routed via the landing zone firewalls does not account for our virtual WAN. Because of this the All Internet traffic should be routed via your deployed Azure Firewall registers as non-compliant.

Decision Drivers

• The requirement to be compliant with the Azure Security Benchmark
• The ability to utilize Azure Virtual WAN

Considered Options

• Exempt the landing zone VNETs from the 'All Internet traffic should be routed via your deployed Azure Firewall' policy

Decision Outcome

Chosen option: "Exempt the landing zone VNETs from the 'All Internet traffic should be routed via your deployed Azure Firewall' policy", because: * We use the Secured Virtual Hub * All our traffic is routed over an Azure Firewall * the policy is unable to detect this