Technical Tip: How to allow all users to access Azure while blocking all other internet traffic

[kumarh]

Description	This article describes how to configure FortiGate to allow all users to access Microsoft Azure services while restricting access to all other internet traffic.
Scope	FortiGate.
Solution	The configuration consists of three key firewall policies: Allowing DNS traffic for domain resolution. Allowing traffic to Azure services. Blocking all other internet traffic. Without a proper DNS resolution mechanism, users won’t be able to reach Azure services by hostname. Create a policy to allow DNS traffic. This will make sure users can resolve domain names before accessing Azure services.                                                                                               Create a policy to allow Azure traffic. This allows users to access specific services only.                                                                             Create a firewall policy to block all other traffic.                                                                        After applying the above configuration, users will only be able to access Microsoft Azure services while all other internet traffic remains blocked. Note: Make sure the Allow policy is above the Block policy.