Azure Firewall operates in a single VNET. Azure Firewall is a regional service. Yes. Vnet1: Same VNET and same region. No. Vnet2: Same Resource Group but different VNET and different region. Must be in the same region. No. Vnet3: Different VNET, different region. Must be in the same region. No. Vnet4: Different VNET, same region. Reference: https://docs.microsoft.com/en-us/azure/architecture/networking/guide/well-architected-framework- azure-firewall