Azure Firewall Standard fails in one availability zone in East US 2 but deploys in another

yes, based on the details you've provided the behaviour is consistent with a zone-specific resource allocation issue within the Azure Firewall deployment infrastructure, rather than a problem with the firewall policy, subnet configuration, public IP, deployment tooling, or subscription quotas.

Zone-specific failures are possible

Azure Firewall deployments can encounter availability zone allocation constraints where a deployment fails in one zone while succeeding in another. Given that the same configuration consistently succeeds in Zone 2 but fails in Zone 1, and that the behaviour is reproducible through both Terraform and the Azure portal, the evidence points away from a configuration issue and towards the underlying resource allocation process associated with the target zone.

Microsoft does not publish a recovery SLA or expected resolution timeframe for transient allocation failures. As a result, there is no documented timeframe for when a particular zone may become available again.

There is no customer-facing Azure Firewall zone-capacity check

Azure does not expose an API or portal capability that reports Azure Firewall capacity availability by individual availability zone. In practice, the deployment attempt itself is often the only way to determine whether the required resources can be allocated in a specific zone.

The Azure Firewall known issues page can sometimes identify broader platform restrictions or zone-related limitations, but the absence of an issue does not guarantee successful allocation within a particular zone.

Check Zone Peers is the correct way to compare zone mappings across subscriptions

Yes. The Check Zone Peers API is specifically intended to compare logical-to-physical availability zone mappings between subscriptions.

This is particularly relevant in your scenario because a logical Zone 1 in Subscription A does not necessarily represent the same physical datacentre zone as logical Zone 1 in Subscription B. Therefore, if the same firewall deployment succeeds in another subscription, comparing the mappings can help determine whether the deployments are actually targeting different physical zones.

Treat zone changes as a planned infrastructure change

Azure Firewall zone configuration is defined as part of the resource deployment. Before planning a change from a single-zone deployment to a different zonal or zone-redundant configuration, verify the supported update behaviour for the Azure Firewall resource provider and API version being used.

From an operational perspective, it is prudent to treat any zone reconfiguration as a planned infrastructure change and validate the process in a non-production environment before applying it to production workloads.

Zones 2 and 3 can provide cross-zone resiliency

If both Zones 2 and 3 are available and represent distinct physical availability zones, deploying Azure Firewall across those zones can provide cross-zone resiliency even when Zone 1 is unavailable.

Before adopting that approach, I would recommend validating the logical-to-physical mapping using Check Zone Peers, particularly if you are comparing behaviour across multiple subscriptions. The important consideration is that the selected logical zones must map to separate physical zones in the target subscription.

One additional observation: because both Terraform and Azure Portal deployments exhibit the same failure pattern, you can largely eliminate Terraform state issues, provider-version issues, template syntax issues, and portal-specific deployment problems from the troubleshooting scope. That makes the zone-specific allocation behaviour a much stronger signal.

Based on the evidence provided, the next practical steps would be:

• Validate logical to physical zone mappings using Check Zone Peers.
• Test deployment in Zone 3 independently.
• If Zone 3 succeeds, evaluate a Zones 2+3 deployment for resiliency.
• Compare mappings across subscriptions to determine whether the failing logical zone corresponds to the same physical zone.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.