A company requires outbound TLS inspection for SaaS access and intrusion detection/prevention for east-west traffic between VNets. A central security team must enforce global rules while allowing regional teams to add exceptions. What Azure Firewall design should you recommend?

Azure Firewall Premium is the correct choice because it offers both TLS inspection for outbound SaaS access and Intrusion Detection and Prevention System (IDPS) for east-west traffic, meeting the core requirements. The hierarchical Firewall Policy structure, with a parent policy at the management group level and child policies for regional exceptions, allows the central security team to enforce global rules while granting regional teams flexibility. Azure Firewall Standard lacks TLS inspection and IDPS. Deploying Premium Firewalls in each VNet without a policy hierarchy would prevent central management and global rule enforcement. While a third-party NVA could provide these features, the question asks for an Azure Firewall design. Azure Firewall Basic does not support TLS inspection or IDPS.