Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=azure

Sophos Firewall on Microsoft Azure

You can deploy Sophos Firewall as a pre-configured virtual machine (VM) on Microsoft Azure. Similar to selecting different sizes for hardware appliances, you can select VM types and sizes.

You can also integrate services such as Microsoft Entra Domain Services, connect an on-premise Sophos Firewall to Microsoft Azure through a route-based IPsec VPN connection, and load-balance Sophos Firewalls.

Licensing

Microsoft Azure VM costs are separate from Sophos Firewall software costs. The available license types are Pay-As-You-Go (PAYG) and Bring-Your-Own-License (BYOL).

PAYG

You pay hourly depending on your usage, with no minimum commitment, and you can stop anytime. Computer workloads that experience high utilization at peak times of the year but low utilization at off-peak times, such as tax or retail websites, may benefit from PAYG. You can scale the capacity of your Sophos Firewall up or down as required while paying only for what you use.

PAYG includes all features and functionality of the Sophos Firewall Xstream protection bundle. However, you can't subscribe to individual licenses or add Enhanced Plus Support. See License bundles.

PAYG is available from Microsoft Azure and is limited to Microsoft remittance countries. If PAYG isn't available in your country, you can use BYOL. See Pay-as-you-go.

For recommended VM size and pricing options, see Sophos Firewall PAYG pricing when running on recommended VMs.

BYOL

Sophos Firewall software licenses offer a variety of bundles, subscriptions, and support options. You can select a term of one, two, or three years. You can also select software subscriptions, such as Network Protection, Web Protection, and Zero-Day Protection, and add Enhanced Plus Support. See Firewall licenses.

BYOL is available from authorized Sophos resellers. You can also contact us for BYOL pricing at azure.marketplace@sophos.com.

Server Protection on Microsoft Azure

Server Protection is offered under BYOL. It runs on VMs on Microsoft Azure environments but isn't available through the Microsoft Azure Marketplace. Server Protection licenses are available from authorized Sophos resellers.

When you purchase a Server Protection license, you apply it through Sophos Central. See Server Protection.

More resources