Network - 25539 IDPS Inspection is Enabled in Deny Mode on Azure Firewall

[komalp2025]

Task ID - https://github.com/microsoft/ztspecs/issues/46

[merill]

We need a Passed or Failed (or Skipped if not connected or error occurs). See what Sandeep is doing for a similar test.

[komalp2025]

We need a Passed or Failed (or Skipped if not connected or error occurs). See what Sandeep is doing for a similar test.

Hi @merill , I have updated the code accordingly and add skip logic before return. Also for policy with non premium tier, i we need to silently continue with it as in one subscription there can be premium / non premium policy.

[Copilot]

Pull request overview

This PR adds a new test (25539) to validate that Azure Firewall Premium policies have Intrusion Detection and Prevention System (IDPS) enabled in "Deny" mode, ensuring that malicious traffic patterns are actively blocked.

Changes:

• Adds PowerShell test to check IDPS configuration across Azure Firewall Premium policies
• Includes markdown documentation explaining IDPS requirements and remediation steps
• Implements subscription-wide scanning with proper error handling for access denied scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
src/powershell/tests/Test-Assessment.25539.ps1	Implements the test logic to enumerate Azure subscriptions, retrieve firewall policies, and validate IDPS settings
src/powershell/tests/Test-Assessment.25539.md	Provides documentation about IDPS functionality, test criteria, and remediation guidance

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

There's a potential null reference issue here. While line 158 checks if Properties exists, it doesn't check if the sku property exists before accessing sku.tier. If a firewall policy's sku property is null or missing, this line will throw an error. Consider adding a null check, such as: if ($policyResource.Properties.sku -and $policyResource.Properties.sku.tier -ne 'Premium')

Suggested change

	if ($policyResource.Properties.sku.tier -ne 'Premium') {
	if (-not $policyResource.Properties.sku -or $policyResource.Properties.sku.tier -ne 'Premium') {

[komalp2025]

closing the branch, messed up during rebasing.