>
    Strata Copilot
    What's New
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for Azure Release Notes
    3. What's New
    Download PDF
    Cloud NGFW for Azure

    What's New

    Table of Contents

    What's New

    Learn about new features for Cloud NGFW for Azure.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for Azure
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Portals (CSP) account
    • Azure Marketplace subscription
    Here’s what’s new in Cloud NGFW for Azure.

    What's New in March 2026

    NewDescription
    Cloud NGFW for Azure: Moving to PAN-OS 11.2
    Any new Azure tenant deploying Cloud NGFW for Azure, will now be on PAN-OS version 11.2.
    New Customers: Starting March 18, 2026, all new Cloud NGFW for Azure tenants will have PAN-OS 11.2 enabled by default.
    Existing Customers: Upgrades start mid-April 2026. To prepare for the mandatory upgrade or to request an early upgrade via TAC, please ensure:
    • Panorama Version: 11.2.x (11.2.7-h4 is TAC preferred).
      If your Panorama is on 12.x, use version 12.1.5 or higher.
    • Azure Panorama Plugin: 5.2.3 or higher version.
    For SCM and LRS managed tenants, no additional action is needed. To perform an early upgrade, complete the above (if applicable) and reach out via TAC case.
    For more information, see Panorama Integration Prerequisites.
    Cloud IP tags support for CNGFW for Azure in SCMCloud NGFW for Azure now supports native Cloud IP Tag integration within Strata Cloud Manager to automate scalable policy enforcement in dynamic cloud environments. This feature allows you to enforce security policies based on Azure resource tags instead of static IP addresses, significantly simplifying security management by eliminating the need for manual updates as workloads change. By creating monitoring definitions in SCM, the firewall automatically polls your Azure environment to discover existing tags and detect modifications, ensuring consistent security across your network workloads. For more information, see Cloud IP Tags for Cloud NGFW for Azure.
    Support for Advanced WildFire and Advanced DNS SecurityCloud NGFW for Azure now supports Advanced WildFire (AWF) and Advanced DNS Security (ADNS) for Panorama and SCM managed firewalls. This enhancement allows you to leverage Precision AI-powered detection to stop zero-day malware and sophisticated DNS-based threats in real-time. You can now enable Cloud Inline Analysis within your Anti-Spyware and WildFire Analysis profiles in Panorama or SCM to activate these advanced capabilities. Billing is seamlessly integrated, appearing as specific add-ons in your usage metrics at a rate of 30% of the base firewall credits when enabled. For more information, see Supported Security Policy Management Features and CNGFW for Azure Pricing.
    AWF and ADNS are currently available for all new Cloud NGFW for Azure tenants. For existing tenants, AWF and ADNS will be available following an infrastructure upgrade. The infrastructure upgrades will be rolled out automatically starting in mid-April, 2026. If you require an early access to these capabilities, reach out to Palo Alto Networks Support.
    DNAT Port Range Support
    You can now specify port ranges in DNAT rules. This enhancement simplifies configuration for applications using multiple ports and improves rule scalability by allowing a single entry for an entire range. For more information, see Configure a Source and Destination NAT Rule.

    What's New in December 2025

    NewDescription
    Additional Azure Region
    You can now deploy Cloud NGFW for Azure in New Zealand North region.
    For more information, see Cloud NGFW for Azure Supported Regions.

    What's New in October 2025

    NewDescription
    Billing Change for Cloud NGFW on Azure
    Effective October 2025, Palo Alto Networks is implementing a previously announced change to how Cloud NGFW on Azure costs are billed. When you deploy Cloud NGFW in a Hub vNET, you also established peering between the your spoke vNETs and the hub VNet and redirected traffic to Cloud NGFW. Until now, Palo Alto Networks temporarily absorbed the cost associated with this peering. This $0.01 per GB charge, which reflects Microsoft Azure's standard peering rate, will now be billed directly to your Marketplace billing account as a Pay-As-You-Go (PAYG) charge, even if you are on a credit consumption plan. For more information, see Cloud NGFW Azure pricing.

    What's New in September 2025

    NewDescription
    Azure Monitor Metrics
    Cloud NGFW now publishes additional metrics in Azure Monitor to help you monitor your Cloud NGFW's health, performance, and usage patterns.
    Key metrics available include:
    • Throughput
    • Sessions
    • SNAT Port Utilization
    • Latency
    • Packet counts
    For more information, see View Cloud NGFW for Azure Monitoring Metrics.
    Support for Multi-Dimensional Scaling
    Cloud NGFW for Azure can now automatically scale based on additional metrics such as Source NAT port utilization, session throughput and session count, ensuring greater reliability and performance for diverse workloads. For more information, see Cloud NGFW for Azure Resiliency and Scalability and View Cloud NGFW for Azure Metrics natively in Azure .
    Strata Logging Service Support for Panorama Managed Cloud NGFW resourcesYou can now enable SLS for existing Panorama-managed Cloud NGFW for Azure resources by simply generating a new registration string from the Panorama plugin and updating it in the Azure portal. For more information, see Enable Strata Logging Service (SLS) for existing Panorama-managed firewalls and View Traffic and Threat Logs in Strata Logging Service.
    Blogs, Articles, and VideosPalo Alto Cloud NGFW deep dive, feature updates, end-to-end lab (Part - 2).

    What's New in July 2025

    NewDescription
    Additional Azure Regions
    You can now deploy Cloud NGFW for Azure in the following regions:
    • Spain Central
    • Mexico Central
    • India South
    For more information, see Cloud NGFW for Azure Supported Regions.
    SNAT Port EnhancementMore SNAT ports are now allocated for each firewall instance. SNAT port allocation will scale based on the front-end IPs configured.
    Blogs, Articles & VideosSecure Traffic Based on Azure Service Tags (Video)

    What's New in June 2025

    NewDescription
    Centralized Management Add-on- Strata Cloud Manager
    You can now use Strata Cloud Manager to manage security policies in your Cloud NGFW resources. In that case, your centralized management add-on consumption is metered on each NGFW resource for each hour associated with a Strata Cloud Manager, as well as for the amount of traffic processed by that NGFW resource. For more information, see Cloud NGFW for Azure Pricing.
    Blogs, Articles & VideosCloud NGFW is essential for AWS & Azure Traffic Protection (Blog)

    What's New in May 2025

    NewDescription
    Panorama Device license Waiver for Cloud NGFW for Azure resources
    You no longer need to pay for additional device licenses to manage policy rules in Cloud NGFW for Azure resources. Panorama (version 11.2.6 or above) does not count these NGFW resources against its managed device license count.
    Blogs, Articles & VideosHarnessing Cloud NGFW for Azure with Palo Alto Networks and Microsoft (Blog)

    What's New in April 2025

    New
    Description
    Cloud NGFW Credit Usage Visibility
    You can now use the Cloud NGFW Credits Management Console to gain greater visibility into how your Cloud NGFW credits are used. You can now analyze your usage at different periods at a summary level for your tenant and NGFW resources. You can also analyze your usage at a granular level for each Cloud NGFW resource, for the traffic secured, for the Cloud-Delivered Security Services (CDSS) and for Centralized Management (Panorama, Strata Cloud Manager, and Strata Logging Services). For more information, see Credit Usage Visibility.

    What's New in March 2025

    New
    Description
    Cloud NGFW Policy Management Using Strata Cloud Manager
    You can register your Cloud NGFW resources with an existing Strata Cloud Manager, which you had previously activated based on Prisma Access (SCM Essentials), or Strata Cloud Manager Pro/Essential licenses. If you do not have a Strata Cloud Manager, you can activate a new Strata Cloud Manager Essentials (steps 1-8) to use with Cloud NGFW for Azure. In either case, the integration automatically enables Strata Cloud Manager Pro features for Cloud NGFW.

    What's New in December 2024

    New
    Description
    Strata Logging Service Support for Panorama Managed Cloud NGFW resources
    When managing Cloud NGFW resources with Panorama, you can now stream the logs to the Strata logging service. You can then use Strata Logging Service to perform Explore/Log Viewer queries to view logs generated by specific Cloud NGFW for Azure resources. When used with Cloud NGFW for Azure, Strata Logging Service automatically scales. As traffic throughput increases on these Cloud NGFW resources, so does your available Strata Logging Service storage so that you don't need to worry about making manual adjustments to storage to save your log data. For more information, see View Traffic and Threat Logs in Strata Logging Service.
    Cloud NGFW Policy Management using Strata Cloud Manager
    You can now register your Cloud NGFW resource with Strata Cloud Manager (SCM) for policy management. With this feature, you can use a single Strata Cloud Manager (SaaS instance) to centrally manage a shared set of security rules on Cloud NGFW resources alongside your physical and virtual firewall appliances.
    See Strata Cloud Manager Policy Management for more information.
    Pricing and Billing Changes
    Cloud NGFW for Azure changes the pricing structure to provide more flexibility. See the Pricing page for more information.

    What's New in November 2024

    New
    Description
    Blogs, Articles, & Videos
    Cloud NGFW for Azure Deployment Architectures

    What's New in October 2024

    New
    Descriptions
    Increased Support for DNAT Rules and Public IP Addresses
    You can now configure up to 120 DNAT rules in Front-end settings in Cloud NGFW resources. Additionally, you can associate up to 120 Public IP addresses with each Cloud NGFW resource. Refer to the Step 3 in the documentation here.
    Blogs, Articles, & Videos

    What's New in September 2024

    New
    Description
    Cloud NGFW Certifications
    Cloud NGFW is now a Payment Card Industry Data Security Standard (PCI DSS) compliant service. Additionally, Cloud NGFW complies with SOC2 HIPAA, ISO ( ISO 27001, ISO 27017, ISO 27018, ISO 27701), CSA STAR, IRAP, and Germany C5 standards. To learn more, visit Cloud NGFW for Azure Certifications.
    Blogs, Articles, & Videos
    Cloud Native Security: Revolutionizing Cloud Environments with Cloud NGFW Blog

    What's New in August 2024

    New
    Description
    Credit Distribution and Management
    You can now use the Cloud NGFW credits to fund both Cloud NGFW resources in AWS and Azure and all related CDSS services you would like to use with it. Use the credits for Panorama, Strata Cloud Manager, or the Strata Logging Service. For more information, see Cloud NGFW Credit Distribution and Management.
    Blogs, Articles, & Videos
    Cloud NGFW Credits Video

    What's New in July 2024

    New
    Description
    Blogs, Articles, & Videos

    What's New in June 2024

    New
    Description
    Additional Azure Region Support
    Cloud NGFW for Azure is now available in the following Azure regions:
    • Japan West (Osaka)
    • Sweden Central (Gavle)
    • Italy North (Milan)
    • South Africa North (Johannesburg)
    • Israel Central
    • West Central US (Wyoming)
    • UAE North (Dubai)
    See Supported Regions and Zones for the complete list of supported regions.

    What's New in May 2024

    New
    Description
    Use XFF Header Value to Enforce Security Policy
    Your Cloud NGFW for Azure can now use an IP address in an X-Forwarded-For (XFF) header to enforce security policy created on Panorama.
    Additional Azure Region Support
    Cloud NGFW for Azure is now available in the following Azure regions:
    • Canada East
    See Supported Regions and Zones for the complete list of supported regions.
    Credit Consumption and Usage Visibility
    		You can now use credits for Cloud NGFW consumption for long-term contracts which you allocate for your firewall resources across Azure cloud environments at tenant level. For more information, see Credit Usage Visibility.

    What's New in March 2024

    New
    Description
    Additional Azure Region Support
    Cloud NGFW for Azure is now available in the following Azure regions:
    • Norway East
    • Germany West Central
    • Central India
    • Switzerland North
    See Supported Regions and Zones for the complete list of supported regions.
    Azure Networking Charges
    Cloud NGFW for Azure bills virtual network peering charges under the Azure Networking charges dimension. The consumption details are shared to the Azure Marketplace. Usage is tracked for inbound (from Internet to VNET), outbound (to Internet from VNET) and east-west traffic (across VNETs). For more information on the charges, see the Pricing page.
    Support for Inbound Decryption
    		Cloud NGFW for Azure uses SSL Inbound Decryption to inspect and decrypt inbound SSL/TLS traffic from a client to a targeted network server and block suspicious sessions.

    What's New in February 2024

    New
    Description
    Multiple Log Destinations
    		You can now send logs from your Panorama-managed Cloud NGFW for Azure resource to Azure Log Analytics Workspace, Syslog Servers, and Panorama. See Multiple Log Destinations on Cloud NGFW for Azure more information.
    Additional Azure Region Support
    		Cloud NGFW for Azure is now available in the following Azure regions:
    • France Central
    • South Central US
    See Supported Regions and Zones for the complete list of supported regions.

    What's New in January 2024

    New
    Description
    Support for 100Gbps
    		This release enables the Cloud NGFW for Azure to automatically scale up to 100Gbps for both vNET and vWAN deployments. See Deploy the Cloud NGFW in a vNET and Deploy the Cloud NGFW in a vWAN for more information.

    What's New in December 2023

    New
    Description
    Additional Azure Region Support
    		Cloud NGFW for Azure is now available in the following Azure regions:
    • North Central United States
    • Southeast Asia
    See Supported Regions and Zones for the complete list of supported regions.
    Support for Private Source NAT
    		This release adds support for Private Source NAT. With this support, you can create a Private NAT gateway to perform network address translation (NAT).

    What’s New in November 2023

    New
    Description
    Additional Azure Region Support
    		Cloud NGFW for Azure is now available in the following Azure regions:
    • Japan East
    • Brazil South
    See Supported Regions and Zones for the complete list of supported regions.
    Rulestack enhancements
    		This release supports implicit rule deletions in a rulestack. With this enhancement:
    • You can delete non-empty unassociated rulestacks without deleting any rules and objects.
    • You can delete resource groups while retaining empty or non-empty unassociated rulestacks.
    • You can delete non-empty unassociated rulestacks using the Azure CLI, CDK, PowerShell and Terraform.
    This deletion functionality applies to uncommitted and running non-empty rulestacks.
    Support for DNS Security Service
    		Cloud NGFW for Azure adds support for the Palo Alto Networks DNS Security service. This service allows you to protect vNET and vWAN traffic from advanced DNS-based threats by monitoring and controlling the domains that your network resources query. For more information, see Enable DNS Security on Cloud NGFW for Azure.
    Support for Non-RFC 1918
    		This release adds support for additional private IP ranges besides those addresses specified in RFC 1918 for vNET and vWAN deployments. With this support, you can use public IP address blocks (for example, 40.0.0.0/24) as your private network without routing the traffic to the internet. For more information about this feature in vNET deployments, see the information provided in the Networking Section (step 5) Additional Prefixes to Private Traffic Range.

    What’s New in October 2023

    New
    Description
    Additional Azure Region Support
    		Cloud NGFW for Azure is now available in the following Azure regions:
    • US West 2
    • North Europe
    See Supported Regions and Zones for the complete list of supported regions.
    Programmatic Access
    		Programmatic access allows you to create and manage NGFWs and rulestacks using APIs. Using these APIs, you can invoke actions on Cloud NGFW resources through an application or third-party tool. The table below provides information about supported tools:
    TerraformUse the Azure Provider to configure infrastructure using Azure Resource Manager APIs.
    PowerShellUse Microsoft Azure PowerShell cmdlets to configure Cloud NGFW for Azure.
    CLIUse these commands to manage your Cloud NGFW for Azure resources.
    SDKSDK package for Python is supported.

    What’s New in September 2023

    New
    Description
    Integrate SSO login flow with your Support Portal account
    		Integrate your organization’s SSO login flow with your Palo Alto Networks Customer Support Portal account for your Cloud NGFW for Azure subscription.
    Support for public domain email addresses
    		This release adds support for public domain email addresses for Customer Support Portal accounts. Previously, users who managed Cloud NGFW assets and related support cases needed a corporate email address to log into the account. With this added functionality:
    • Public domain users access assets and support cases in accounts where they are members.
    • RBAC access controls are assignable and applied to users with public domain emails.
    • A user with a public domain email address in one account can't access assets and support cases in another account. Resolve this issue by adding the user with the public domain email address to the account they need to access.
    • A user with a public domain email address is assigned any role, including superuser and domain administrator.
    • An account can have one or more users with a public domain email address. If an account was created by a user with a public domain email address, the account is considered public.
      An account can't have a mix of users with corporate and public email addresses.
      The following public domain email addresses are supported:
      gmail.comyahoo.*hotmail.*
      live.*outlook.comaol.com
      gms.* (gmx.de, gmx.net, gmx.us)icloud.commsn.com
      comcast.net**att.net

    What’s New in August 2023

    New
    Description
    General availability
    Cloud NGFW for Azure has reached general availability. This release includes numerous fixes, support for additional regions, and enhancements to the pay-as-you-go (PAYG) subscription model.

    What’s New in June 2023

    New
    Description
    Health Monitoring
    View the overall health status of the Cloud NGFW firewall, connection status, and diagnostic information. Use this information to determine the cause of an unhealthy firewall state. See Monitor Cloud NGFW Health for more information.

    What’s New in May 2023

    New
    Description
    Initial release of Cloud NGFW for Azure
    The initial release of Cloud NGFW for Azure includes the following features:

    © 2026 Palo Alto Networks, Inc. All rights reserved.