>
    Strata Copilot
    Cloud NGFW for Azure Pricing
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for Azure Reference
    3. Cloud NGFW for Azure Pricing
    Download PDF
    Cloud NGFW for Azure

    Cloud NGFW for Azure Pricing

    Table of Contents

    Cloud NGFW for Azure Pricing

    Learn about Cloud NGFW for Azure pricing.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for Azure
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Portals (CSP) account
    • Azure Marketplace subscription
    Pay-As-You-Go
    Cloud NGFW is available as a pay-as-you-go (PAYG) subscription in the Azure Marketplace. With this model, you pay only for what you use each month, and also enjoy Azure Marketplace benefits such as consolidated billing and credit toward an organization’s Microsoft Azure Consumption Commitment (MACC).
    You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource. Additionally, you pay an hourly rate and for the amount of traffic processed by your Cloud NGFW resource when you configure security services add-ons (such as Threat Prevention, Advanced URL Filtering, DNS Security, or WildFire®) or the centralized management add-on (Panorama management).
    Credit Pricing Model
    You can procure and associate Cloud NGFW for Azure Credits to your tenant by paying an upfront cost for a long-term contract from a one-year to a five-year time frame. You can procure these credits directly from Azure Marketplace or at a private price from Palo Alto Networks or its partners. By purchasing credits you can also take advantage of Azure Marketplace benefits such as consolidated billing, MACC committed consumptions and automated renewals. Cloud NGFW credits allow you to consume Cloud NGFW resources in your tenant at a lower cost up to a specific capacity until your contract expires.
    If your average consumption per month exceeds the purchased credits, overages apply at PAYG rates.
    If you add Cloud NGFW credits during a free-trial period, your contract begins immediately and overrides the free trial.
    Use the Cloud NGFW for Azure pricing estimator to help you determine Azure pricing for your Cloud NGFW tenant.
    Metering and Billing
    You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource.

    Base NGFW Resource Consumption

    You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource.
    DimensionPrice (Per Hour)Price (Per GB)Equivalent Cloud NGFW Credits
    Base NGFW Resource Usage$1.25—104.17
    Traffic Secured per GB per Tenant—$0.0161.33
    Add-ons$0.12 per 10 Cloud NGFW Credits—See below for specific billing information for each add-on.
    Azure Networking Charges—$0.010 cents per Unit—
    Cloud NGFW for Azure bills the Egress usage (outbound and peering charges) under Azure Networking charges dimension. For more information, refer to the Azure Networking Charges.
    Cloud NGFW for Azure bills the Egress usage (inbound, outbound, and east-west traffic) under Azure Networking charges dimension, and then the Azure Marketplace receives the consumption details. Azure virtual network pricing determines these charges. For more information, see Virtual Network Pricing.
    Each NGFW resource you deploy meters usage hours. Traffic is metered across all NGFW resources deployed in your Cloud NGFW tenant.

    Cloud-Delivered Security Services (CDSS) Consumption

    Cloud NGFW for Azure bills the usages of these security services using the add-ons dimension. Cloud NGFW for Azure measures usage in $/hour and $/GB as detailed in the following table.
    Cloud NGFW for Azure does not support per-rule billing for add-on security services. If any of your security rules have a security profile enabled (such as Threat Prevention, Advanced URL Filtering, DNS Security, or WildFire), you will be charged for add-on services for all traffic that is processed by the NGFW, not just the traffic that matches the rule with the security profile.
    For example, if you have two security rules:
    • Rule 1: Allows traffic to a specific destination with an Advanced URL Filtering profile.
    • Rule 2: Allows all other traffic with no security profile.
    In this scenario, you will be billed for Advanced URL Filtering for all traffic processed by the NGFW, including the traffic that matches Rule 2. To avoid add-on charges, you must ensure that no security profiles are enabled on any of your security rules.
    Advanced Threat Prevention Add-OnPrice (Per Hour)Price (Per GB)Equivalent Cloud NGFW Credits
    Usage Hour*$0.375—31.25
    Traffic Secured—$0.0050.4
    Advanced URL Filtering Add-OnPrice (Per Hour)Price (Per GB)Equivalent Cloud NGFW Credits
    Usage Hour*$0.375—31.25
    Traffic Secured—$0.0050.4
    Advanced WildFire Add-OnPrice (Per Hour)Price (Per GB)Equivalent Cloud NGFW Credits
    Usage Hour*$0.375—31.25
    Traffic Secured—$0.0050.4
    ADNS Security Add-OnPrice (Per Hour)Price (Per GB)Equivalent Cloud NGFW Credits
    Usage Hour*$0.375—31.25
    Traffic Secured—$0.0050.4
    *Usage hour is metered on each NGFW resource with CDSS add-ons enabled.

    Centralized Management Add-On

    You can use a Panorama virtual appliance to manage policy rules in your Cloud NGFW tenant. Centralized management add-on consumption is metered on each NGFW resource for each hour you have associated with a Panorama appliance and for the amount of traffic processed by that NGFW. The rate you’re charged for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).
    You no longer need to pay for additional device licenses to manage policy rules in Cloud NGFW for Azure resources. Panorama (version 11.2.6 or above) does not count these NGFW resources against its managed device license count.
    Traffic Secured
    Price per Hour
    		Price per GBEquivalent Cloud NGFW Credits
    Usage Hour$0.250—20.83
    Traffic Secured
    		—$0.0030.27

    Strata Cloud Manager

    You can use Strata Cloud Manager to manage security policies in your Cloud NGFW tenant. The rate you are charged for the traffic depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).
    Traffic Secured
    Price per Hour
    		Price per GBEquivalent Cloud NGFW Credits
    Usage Hour$0.375—31.25
    Traffic Secured—$0.0050.4

    Azure Networking Charges

    Since Cloud NGFW hosts the resources in the Palo Alto Networks tenant on your behalf, the data transfer costs are billed to the firewall service provider (Palo Alto Networks), which we then pass on to you.
    The charges will align exactly with Microsoft's official bandwidth pricing meters. Depending on your network traffic, you may get charged for one or more of the following types of data transfer if you had hosted these firewalls in your tenant.
    • Standard Data Transfer Out (Internet Egress) - When your Azure applications send data to the public internet (For example: serving a website to external users or downloading updates).
    • Inter-Region Data Transfer- When your Azure applications send data from one Azure region to a different Azure region.
    • VNet Peering Traffic charges- When your applications in the Spoke VNets send or receive traffic from the firewall in the Hub VNEts (local peering and Global peering).
    These charges are calculated strictly using Microsoft's official per-gigabyte pricing for Internet Egress, peering, and Inter-Region transfers; inbound traffic remains completely free. On your invoice, these bandwidth charges are summarized into a single line item ("Azure Networking charges") showing a calculated quantity at an effective price of $0.01 per unit.
    Because these costs from Microsoft Azure, Palo Alto Networks cannot discount them. Furthermore, since they are billed directly to the firewall service provider, your Microsoft Enterprise Agreement (EA) discounts do not apply. If you need a detailed breakdown of the effective prices, contact TAC support with your Resource ID to obtain a full cost report for the previous month.

    Official Azure Pricing References

    Because these are Microsoft's fees, the rates are dictated by standard Azure pricing. You can verify the exact costs per gigabyte using Microsoft's official resources:

    Migrate to the New Pricing Plan

    Complete the following procedure to migrate your existing Cloud NGFW for Azure resources to the new pricing plan (described above).
    Complete the following steps, regardless of the payment mode (PAYG or Private Contract), to take advantage of the new pricing option.
    Complete this procedure on each Cloud NGFW for Azure firewall.
    1. Log in to the Azure portal.
    2. Select your Cloud NGFW for the Azure firewall deployed in your tenant and navigate to the Overview page.
    3. Click Change Plan.
    4. Select the new pricing plan. The new pricing plan does not have tiered pricing based on the amount of traffic secured.
    5. Click Change Plan to confirm.
    6. You can verify the plan change on the firewall Overview page. The Plan ID will state panw-cngfw-payg.
      Moving to the new pricing plan requires no additional actions after completing the above procedure.

    End of Sale Announcement: DNS and WF subscription

    Effective March 10, 2026, the DNS and WF subscription will no longer be available for sale on Cloud NGFW for any new customer onboarding the Firewall. The DNS and WF subscriptions will be replaced with ADNS and AWF. Please note that support for existing TP and DNS customers will continue until the end of FY26 (July 31, 2026). Post July 31, 2026 the existing customers will automatically be consuming ADNS and AWF subscriptions.

    © 2026 Palo Alto Networks, Inc. All rights reserved.