Azure Firewall - RuleCollection with no rules

Question

1. What happens if a rule collection (network, NAT, or application) is defined but contains no rules?
   • Will the configured action (e.g., Allow or Deny) still be applied?
   • Does it effectively act as an implicit "Allow All" or "Deny All"?
2. What is the behavior of an empty rule collection group (i.e., one that contains no rule collections at all)?
   • Is it completely ignored?
   • Does it have any implicit effect on traffic processing?

Answer 1

This response makes sense and seems accurate, however it also contradicts this MS Learn article introducing both rule collections and rule collection groups, stating "rule collection groups contain one or multiple rule collections" and "a rule collection … contains one or more rules".

Its explanation could instead read "rule collection groups contain zero or multiple rule collections" and "[a] rule collection … contains zero or more rules". For clarity, it could also explain that empty rule collection groups and empty rule collections are both effectively ignored, having no impact on traffic presented to the firewall.

Answer 2

Hello Peter Stieber

Please check below details:

What happens if a rule collection (network, NAT, or application) is defined but contains no rules?

If a rule collection (whether it's a network, NAT, or application rule collection) has no rules, the configured action (like Allow or Deny) does not get applied to any traffic. An empty rule collection acts as if it doesn't exist, so it doesn't effectively create an implicit 'Allow All' or 'Deny All' scenario. Traffic won't be affected by that rule collection at all, since there's nothing in it to enforce."

• Rule collections only apply their action (Allow/Deny) when at least one rule matches.
• If there are no rules, then no match is possible, and the collection is skipped.
• Azure Firewall has an implicit deny at the end of rule processing, so unmatched traffic is denied by default.
• This behavior is consistent across network, NAT, and application rule collections.

What is the behavior of an empty rule collection group (i.e., one that contains no rule collections at all)?

A rule collection group is a container for multiple rule collections. If a group contains no rule collections at all:

• It is completely ignored by Azure Firewall.
• It has no implicit effect on traffic and It does not override or interfere with other rule collection groups.

Summary: An empty rule collection group is non-functional and has no impact on traffic.

Refer: https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

---

I hope this helps! If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

If the above is unclear or you are unsure about something, please add a comment below.