How to check Cloud NGFW for Azure OS upgrade history

[SecurityNew]

We are using Palo Alto Cloud NGFW for Azure and need to verify the OS/software upgrade details for our deployed firewalls.

Could you please let us know:

• How to check the current PAN-OS/software version running on Cloud NGFW?
• Where can we find the OS upgrade start time and end time for previous upgrades?
• Are upgrade logs available in Azure Portal, Cloud NGFW console, SCM, or Panorama?
• Is there any CLI/API method to retrieve the upgrade history and timestamps?

We require the exact upgrade timeline for our Cloud NGFW instances connected to Azure.

Any guidance or documentation would be appreciated.

Thanks.

[DanielS.Romero]

Hello @SecurityNew 

Palo Alto Networks Cloud NGFW is a machine learning (ML)-powered Next-Generation Firewall (NGFW) delivered as a fully managed, cloud-native service on public cloud platforms like Amazon Web Services (AWS) and Microsoft Azure. (There's not CLI/GUI access for customers). It operates as a Firewall-as-a-Service (FWaaS) solution, eliminating the need for on-premises hardware and minimizing infrastructure management.

Palo Alto Networks manages the deployment, scaling, updates, routing and maintenance, allowing security teams to focus on strategic priorities (Policy review, object management, and traffic logs in Panorama/SCM).

For Cloud NGFW for Azure, information regarding the current PAN-OS/software version, upgrade timelines, and log availability is managed through a combination of Palo Alto Networks' central management, Azure services, and customer support channels.

Current PAN-OS/Software Version

The PAN-OS version for Cloud NGFW for Azure instances is managed by Palo Alto Networks.

For new deployments: As of March 18, 2026, all new Cloud NGFW for Azure tenants are provisioned with PAN-OS 11.2 by default.

For existing deployments: Upgrades for existing customers began in mid-April 2026 to move to PAN-OS 11.2. If your Cloud NGFW is managed by Strata Cloud Manager (SCM) or a Log Retrieval Service (LRS), no additional action is typically needed for these mandatory upgrades. You can request an early upgrade by submitting a support case.

While there isn't a direct customer-facing console on the Cloud NGFW itself to check the PAN-OS version, the Next Generation Firewalls screen in Strata Cloud Manager (SCM) displays the "Config sync Status" for your Cloud NGFW resources, which reflects their operational state.

OS Upgrade Start and End Times for Previous Upgrades

Upgrade start and end times for Cloud NGFW for Azure are typically communicated and recorded as scheduled maintenance incidents.

- Scheduled maintenance reports, which include software upgrades, are published on the Palo Alto Networks status page. These reports provide specific start and end times for the maintenance window. For example, a scheduled maintenance incident for an upgrade to fwaas-azure-1.9.0-c5.rel version was reported with a start time of October 13, 2023, 22:15pm UTC and a completion time of October 18, 2023, 00:01:42.0Z.

- This indicates that the Palo Alto Networks status page is the primary source for historical upgrade timelines and incident details.

Availability of Upgrade Logs

Upgrade logs, in the traditional sense of detailed system logs for the upgrade process, are not directly accessible to customersfor Cloud NGFW for Azure due to its managed service nature. However, various logging options are available for monitoring general activity and potential impacts.

Azure Portal: Audit logs track user and API activity within your Cloud NGFW tenant and are streamed to Azure, viewable in the Azure Portal . These logs can help audit operations related to firewall resources, such as creating, updating, or deleting rules and policies, which might indirectly relate to changes around an upgrade.

Cloud NGFW Console: There is no specific "Cloud NGFW console" provided for customers to view such logs directly on the instance.

Strata Cloud Manager (SCM) / Strata Logging Service (SLS)/ Panorama: Cloud NGFW for Azure can only stream traffic, threat, and decryption logs to Strata Logging Service (SLS) and Panorama in Panorama or Log-Collector mode.

You can view these logs within the Strata Cloud Manager (SCM) and Panorama console under System Settings > Inventory > Strata Logging Service or the Log Viewer section for SCM and the typical Monitor tap for Panorama. SCM/Panorama allows you to filter logs by Cloud NGFW resource and specify time ranges for historical viewing.

CLI/API Methods for Upgrade History and Timestamps

The Cloud NGFW for Azure is a managed service, and direct CLI or API access to retrieve detailed software upgrade history and timestamps for the underlying PAN-OS is generally not available to customers.

While Cloud NGFW for Azure supports programmatic access to Azure native resources using Azure CLI, SDKs, PowerShell, ARM templates, Bicep, and Terraform for deployment and policy management, these tools are primarily for managing the provisioning and configuration of the Cloud NGFW resource within Azure, not for querying its internal software upgrade history.

For specific inquiries, I recommend opening a technical case with the TAC engineers, who have direct access to the CNGFW CLI and Azure Portal and they can help you resolve any questions.

You only need to provide the following Azure information to the TAC team:

a. Firewall name: 
b. Tenant ID: 
c. Subscription ID:
d. Resource Group name: 
e. Región: 

Reference docs:

https://docs.paloaltonetworks.com/cloud-ngfw-azure/release-notes/cloud-ngfw-for-azure-whats-new
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/protect-traffic-with-cloud-ngfw-fo...
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/protect-traffic-with-cloud-ngfw-fo...
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/protect-traffic-with-cloud-ngfw-fo...
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/monitor-cloud-ngfw-for-azure-resou...
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/monitor-cloud-ngfw-for-azure-resou...
https://www.paloaltonetworks.com/resources/guides/securing-apps-with-cloud-ngfw-for-azure-design-gui...
https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/panorama-plug...
https://docs.paloaltonetworks.com/cloud-ngfw-azure/administration/cloud-ngfw-for-azure-as-code
https://status.paloaltonetworks.com/incidents/pwbdjcvfyjjd
https://status.paloaltonetworks.com/

Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful post.

Best Regards,

Daniel Romero
Senior Network/Security Engineer
PANW Partner