Azure News - 2026-06-20

Purpose of the blog 

This blog outlines the key upcoming changes to Azure Firewall explicit proxy and provides detailed migration guidance for customers using PAC file–based configurations. It also covers the supported deployment options for enabling explicit proxy after the changes are released, including the Azure portal, PowerShell, and Azure CLI.

Who is this article for?

This article is intended for customers currently using Azure Firewall explicit proxy in preview. If you use PAC file–based proxy configuration, follow the steps below to configure the new PAC file SAS URL retrieval method, which will become the standard approach going forward.

Azure Firewall explicit proxy

Azure Firewall operates in a transparent proxy mode by default. In this mode, you use a user-defined route (UDR) configuration to send traffic to the firewall. The firewall intercepts that traffic inline and passes it to the destination.

When you set up explicit proxy on the outbound path, you can configure a proxy setting on the sending application (such as a web browser) with Azure Firewall configured as the proxy. As a result, traffic from the sending application goes to the firewall's private IP address and therefore egresses directly from the firewall without using a UDR.

The Azure Firewall explicit proxy feature is in Preview at the time this article was published.

Upcoming changes to the explicit proxy feature in Azure Firewall

• PAC (Proxy Auto-Configuration) file size is now limited to 256 KB.
• Support HTTP and HTTPS traffic over a single HTTP proxy port.
• Removal of the previous dual-port configuration requirement (explicit proxy v1).
• Ability to enable explicit proxy directly using Firewall Policy creation in the Azure portal.
• Following general availability (GA), explicit proxy will require both a PAC file SAS URL and Managed Identity (MSI), along with the appropriate role assignments to meet Microsoft security standards.

Follow the steps below to migrate to the new PAC file retrieval model that uses customer-managed Azure Storage and Managed Identity authentication.

Step 1: Create a PAC File SAS URL

• Create an Azure Storage container by following the steps in Manage blob containers using the Azure portal - Azure Storage | Microsoft Learn. Note: Use a subscription in which required permissions to add roles exist.
• Upload the PAC file to the storage container.

• Select the uploaded file and copy the file URL. Example URL: "https://eproxypstestresources.blob.core.windows.net/explicitproxycontainer/proxy.pac"

Step 2: Create a Managed Identity and assign required roles

• Navigate to Managed Identity blade and create a Managed Identity. See Manage user-assigned managed identities using the Azure portal - Managed identities for Azure resources | Microsoft Learn for more details.
• Go to the storage account resource created in the previous step and navigate to Access Control (IAM). Select Add to add the role assignment.
• Go to the Add role assignment page and search for Storage Blob Data Contributor and Storage Blob Data Reader, then select both.

• Go to Members → Managed Identity and select the identity created earlier. Review the changes and click Assign in Review + Assign blade.

• Verify that your changes are reflected under Role Assignments by searching for the managed identity. Note: Make sure that the Managed Identity created has prefix "PacFileMSI-".

Configuration using portal, PowerShell and Azure CLI

Portal configuration

After obtaining the PAC file SAS URL and Managed Identity, enable the PAC file in the explicit proxy configuration by:

• providing the PAC file SAS URL, and
• selecting the Managed Identity created in the previous steps.

PowerShell configuration

To securely use explicit proxy, customers must provide:

• the PAC file SAS URL, and
• a Managed Identity with the required permissions to access the PAC file from the customer-managed Blob Storage account.

1. Create Firewall Policy with explicit proxy settings:$exProxy = New-AzFirewallPolicyExplicitProxy ` -EnableExplicitProxy ` -HttpPort 100 ` -EnablePacFile ` -PacFilePort 130 ` -PacFile "https://sampleurlfortesting.blob.core.windows.net/container/proxy.pac"

    

2. Update Firewall Policy with explicit proxy configuration:

   New-AzFirewallPolicy ` -Name "fp1" ` -ResourceGroupName "TestRg" ` -ExplicitProxy $exProxy ` -UserAssignedIdentityId "/subscriptions/e7eb2257-46e4-4826-94df-153853fea38f/resourcegroups/testrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/PacFileMSI-eproxyidentity"

Azure CLI configuration

1. Create Firewall Policy with explicit proxy settings:az network firewall policy create -g "testrg" -n "testfwpolicy" --sku Premium --explicit-proxy enable-explicit-proxy=true http-port=9001 enable-pac-file=true pac-file-port=122 pac-file="https://eproxypstestresources.blob.core.windows.net/explicitproxycontainer/proxy.pac" --identity "Identity_ID"

    

2. Update Firewall Policy with Explicit Proxy Configuration:az network firewall policy update -g "testrg" -n "testfwpolicy" --explicit-proxy enable-explicit-proxy=true http-port=9001 enable-pac-file=true pac-file-port=124 pac-file="https://eproxypstestresources.blob.core.windows.net/explicitproxycontainer/proxy.pac" --identity "Identity_ID"