Azure WAF exclude specific content-type header

Hi eenchev,

Thanks for your question on the Microsoft Q&A portal!

To help us investigate and resolve this for you quickly, could you please provide a few additional details:

• Which WAF SKU are you using—Azure Application Gateway WAF or Azure Front Door WAF?
• What version of the managed rule set are you using?
• What is the exact Rule ID being triggered?
• Are you applying the exclusion globally or per rule?
• Did you configure the exclusion using the correct match variable (e.g., RequestHeaderValues for Content-Type)?
• Have you tried matching the full header value, including charset and case sensitivity?
• Is the Content-Type header value consistent across requests, or does it vary?
• Have you tested the exclusion with controlled requests to isolate the behavior?
• Have you reviewed WAF logs to confirm which part of the request is triggering the rule?
• Has the WAF policy been fully deployed after making changes?
• Are there any custom rules that might conflict with your exclusion?
• Does the Rule ID inspect other parts of the request (e.g., body) that might affect exclusion behavior?

Looking forward to your response so we can assist you further.

Thanks,

Pranitha

Hi Pranitha,

The exact log from the Application gateway is:

{application/scim+json found within [REQUEST_HEADERS:Content-Type:application/scim+json; charset=utf-8]}

The policy is WAF v2 on Application gateway v2 using latest Azure DRS 2.1 ruleset. The Specific ruleid which is matched is 920420. Here are the rule exclusions implemented both global and specific for the ruleid. I have tried only specific and only the global with no success.

{ matchVariable: 'RequestHeaderValues' selectorMatchOperator: 'Contains' selector: 'scim+json'
exclusionManagedRuleSets: [] } { matchVariable: 'RequestHeaderValues' selectorMatchOperator: 'Contains' selector: 'scim+json'
exclusionManagedRuleSets: [ { ruleSetType: 'Microsoft_DefaultRuleSet' ruleSetVersion: '2.1' ruleGroups: [ { ruleGroupName: 'PROTOCOL-ENFORCEMENT' rules: [ { ruleId: '920420' } ] } ] }

I have tried with match selector : application/scim+json as well. WAF logs show only the message provided above: {application/scim+json found within [REQUEST_HEADERS:Content-Type:application/scim+json; charset=utf-8]} . I understand it that specifically the request header value application/scim+json is the reason for the match.

I have to check about specific custom-rules. Besides the kql query in the ApplicationGatewayFirewallLog is there a way to see more in depth information about the rule matches?

Thank you for the suggestions.

Hi eenchev,

Thanks for the detailed follow-up and for sharing your configuration and logs!

You're using Azure Application Gateway WAF v2 with the latest Microsoft Default Rule Set (DRS) 2.1. A managed rule (ID 920420) is being triggered by the Content-Type header value:

application/scim+json; charset=utf-8

You've tried to exclude this header using the match variable RequestHeaderValues with a selector like scim+json, but the rule continues to fire. You've tested both global and rule-specific exclusions and confirmed that the WAF logs show the match is happening on the full header value.

This is because:

The issue is likely due to how WAF exclusions match the full header value, including case sensitivity and exact formatting. The match variable RequestHeaderValues expects a full and exact match (or a substring match depending on the operator), but the presence of charset=utf-8 and potential case differences may cause the exclusion to fail.

Also, the Content-Type header is not split automatically into MIME type and charset—so your selector must account for the full string.

Here is the recommended steps:

To exclude this specific header value from triggering rule 920420, try the following:

Use RequestHeaderValues with full value match

{

"matchVariable": "RequestHeaderValues",

"selectorMatchOperator": "Equals",

"selector": "application/scim+json; charset=utf-8",

"exclusionManagedRuleSets": [

{

"ruleSetType": "Microsoft_DefaultRuleSet",

"ruleSetVersion": "2.1",

"ruleGroups": [

{

"ruleGroupName": "PROTOCOL-ENFORCEMENT",

"rules": [

{

"ruleId": "920420"

}

]

}

]

}

]

}

Ensure the casing and spacing match exactly what appears in the WAF logs. If the logs show charset=utf-8, do not use charset=UTF-8. Useful microsoft documents:

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot?tabs=edge

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=drs21%2Cowasp32

I hope this helps to resolve the issue.

Thanks!

Hi eenchev,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. 

Thanks!

Hi Pranitha,

I tried to add the exclusion as per your recommendation (both via bicep code and azure arm). Apparently the whole string is not allowed: spaces and special characters like semi-column are not allowed. Have you tested it ?

I am trying to substitute with selector: 'application/scim+json%3B%20charset=utf-8'