Azure Network Security Proof of Concept Part 2: Deploying the environment

BrainBruno Apologies for the late response. Please see the architecture here for more information. The outbound traffic will be forwarded to the AppGateway . You can also preserve the Client IP with this design .
The Application Gateway instance terminates the connection from the client, and establishes a new connection with one of the back ends. The UDR in the Application Gateway subnet forwards the packet to the Azure Firewall, while preserving the destination IP to the web application.

As mentioned in point 5 in the link above, Azure Firewall doesn't SNAT the traffic (on the return leg from private to public) since it's going to a private IP address, and forwards the traffic to the Application Gateway. (private to private).