Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource- group-restrictions