Module assessment

To provide direct access to the Azure Virtual Desktop gateway and broker and avoid disconnections during firewall scale-in.

To send all session-host internet traffic directly to the internet.

To make application rules in the Firewall Policy unnecessary.

Deploy Azure Firewall with a Firewall Policy in a hub virtual network, and peer it with the session-host virtual network.

Deploy Azure Firewall in the session-host subnet, and assign a public IP address to each session host.

Deploy separate firewalls on each session host, and manage them without a Firewall Policy.

So the session hosts and Azure Firewall use the same DNS responses when the firewall evaluates FQDN network rules.

So all Azure Virtual Desktop gateway and broker traffic is inspected by the firewall.

So application rules can filter non-HTTP protocols without a network rule.

Use application rules for the WindowsVirtualDesktop FQDN tag and the required supporting and certificate-validation FQDNs.

Use only a WindowsVirtualDesktop service-tag route with Internet as the next hop.

Use a NAT rule to translate inbound traffic to each session host.