routing FSI-adc1 is pointing to ip address on data center microsoft at hong kong, my azure environment is on canada central

Hi, this is normal: that /32 route (e.g., 207.46.147.148/32) appears because you have active Service Endpoints on the subnet (Storage/SQL/Entra, etc.). Azure injects “VirtualNetworkServiceEndpoint” routes that bypass your 0.0.0.0/0 UDR to the firewall and carry traffic directly to the Microsoft service on the backbone network. The geo-IP may show “Hong Kong,” but the traffic exits locally (Canada Central) thanks to anycast. If you want everything to go through the firewall, remove the Service Endpoints from that subnet (VNet → Subnet → Service Endpoints) or, better yet, use Private Endpoints. After removal, the /32 routes will disappear; otherwise, the behavior is expected and safe.

Hi xeb7152,

Thank you for reaching out on Microsoft Q&A forum

You are seeing your default routes to Hong-kong location because of

Service Endpoints: Having active Service Endpoints for services like Azure Storage or SQL Database in your subnet, Azure directs specific routes into your Virtual Network. Allowed routes traffic is bypassing your User Defined Routes to reach Microsoft services directly via backbone network.

Geo-IP Resolution: The geo location might be showing Hong-kong but traffic is routed to the nearest Azure region Canada Central, which is set by you, there is a mechanism that result as above, which supports by azure services called anycast.

If you wish all traffic to go through your firewall, then you can follow as below:

Remove Service Endpoints from the subnet:

Go to VNet → Subnet → Service Endpoints and disable them.

This will remove the /32 routes.

Use Private Endpoints otherwise,as recommended approach for secure and controlled routing.

If you find this comment helpful, please “up-vote” for the information provided , this can be beneficial to community members.

Kindly let us know if you have any additional questions.

Thanks