Enhanced protection for application and data in a single Azure region – Availability Zones provide physical separation of infrastructure within a single Azure region, protecting against datacenter-level failures.

Protect applications and data through high availability with fault isolation and redundancy – They offer fault isolation and redundancy, enabling high availability for applications and services by distributing them across multiple zones within the same region.

Azure does not allow the deployment of virtual machines (VMs) in a gateway subnet. The gateway subnet is specifically reserved for Azure VPN Gateway or ExpressRoute Gateway instances, and deploying other resources in it can cause gateway deployment or operation failures.

Two virtual NICs – The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.

One NSG for each interface – The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet’s best practices.

The Software-defined network (SDN) connector allows FortiGate to dynamically pull metadata such as tags, IP addresses, and resource groups from Azure resources. This enables automatic policy updates based on dynamic IP changes, such as those of a Linux server in a protected subnet.

A Microsoft Entra tenant is the primary administrative unit that represents an organization within Microsoft’s identity platform. It defines the boundary for identity management, access control, and resource governance, and serves as the core entity that connects the organization to Microsoft's cloud services such as Azure and Microsoft 365.

The trace output shows only one hop to reach 10.0.2.4, indicating that the destination is in the same Azure virtual network (VNet) as the Windows VM. Since the VM’s IP is 10.0.1.4 and the destination is 10.0.2.4, they are in different subnets, but Azure allows direct routing between subnets within the same VNet without additional hops.

Azure does not allow you to view an existing client secret’s value after creation for security reasons. If you did not save the client secret when it was first generated, the quickest and only option is to create a new client secret under the existing app registration and use the new value in your FortiGate configuration.