A lock subnet was supposed to send 0.0.0.0/0 to Azure Firewall, but…

Question

A lock subnet was supposed to send 0.0.0.0/0 to Azure Firewall, but a VM still egresses directly to the Internet. How should the security engineer prove the routing miss?

Accepted Answer

Use Network Watcher next hop (and/or connection troubleshoot) to show the effective next hop and confirm a missing or overridden UDR — Thought default route went to the firewall but the VM still sneaks out? Next hop (or connection troubleshoot) shows the real next hop and outs a missing or overridden UDR.

Answer

Assume Azure Firewall always steals default routes, so no diagnostic is required when egress looks direct

Answer

Delete the VM’s NIC and recreate it, which permanently rewrites all route tables in the subscription

Answer

Enable Microsoft Defender for DNS only, which forces all VM egress through Azure Firewall

A lock subnet was supposed to send 0.0.0.0/0 to Azure Firewall, but a VM still egresses directly to the Internet. How should the security engineer prove the routing miss?

Short Explanation

Full Explanation