Can I Skip the Azure Firewall for Specific IPs in vWAN?

If you decide to go ahead with bypassing the firewall, I'd suggest a 'lock and key' method. You could set up your SQL server to allow public access solely from your company's IP address, perform the backup, then disable public access immediately. This can all be scripted using Azure CLI or PowerShell, and we apply similar practices for data migrations between AWS and Azure.

In my opinion, you should carefully consider the implications of bypassing the firewall without approval from your infosec team. If backing up Azure SQL databases is a priority, have you looked into Azure's built-in backup solutions? They can offer geo-redundant options and might save you both hassle and costs.

There are definitely methods to bypass the Azure firewall, though they usually require express routes. I'm not entirely sure if express routes apply to Virtual WAN setups, but it could be worth checking out the Microsoft documentation on FastPath for ExpressRoute, as it might offer a solution for your scenario.

Unfortunately, if you're using routing intent and policies for private traffic, you can't bypass the Azure firewall. However, if you manage route tables manually, you might have more flexibility. You'd need to ensure the vNet address space is advertised directly to your connections, but keep in mind it would be an all-or-nothing scenario. You would have to exclude all of the vNet and on-premises range from the traffic flow, which involves creating and updating route tables and connection propagation settings to adapt.