384 questions with Azure Web Application Firewall tags

Sort by: Updated
1 answer

WebApplicationFirewallPolicy validation failed. Subscriptions without DeveloperPreview flag enabled cannot use Microsoft_DefaultRuleSet_2.2

Attempting to create or update WAF premium policy with DRS 2.2 and I get the error in title. I cannot find what feature to register either in the portal or in powershell/CLI - Nothing references DefaultRuleSet.

Azure Web Application Firewall
asked 2025-12-04T03:47:01.5833333+00:00
Justin M. Szwed 0 Reputation points
commented 2025-12-04T04:16:39.8066667+00:00
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

WAF not allowing above 128KB file Upload

Hello Team, We have some scenario where we need to send large volume of data from Web UI (Front End) to the backend APIs for processing. Often, due to the nature of the business transaction, the data crossed the default limit set in WAF rule, 128KB. That…

Azure Web Application Firewall
asked 2025-11-27T11:46:01.52+00:00
Kaushik Dutta 145 Reputation points
edited a comment 2025-11-27T13:53:16.2433333+00:00
Vallepu Venkateswarlu 1,235 Reputation points Microsoft External Staff Moderator
3 answers

Azure FD Premium w/ WAF Custom Exclusion Rule Not Working

I have an Azure Front Door Premium instance with a WAF in Prevention Mode and Enabled. I created a simple exclusion rule to block traffic coming from my ip address but it is not blocking the traffic. I tried creating a support request but it just kept…

Azure Web Application Firewall
asked 2025-11-20T19:44:36.44+00:00
Michael Paterson 0 Reputation points
edited an answer 2025-11-27T11:38:42.52+00:00
Vallepu Venkateswarlu 1,235 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

WAF policy custom rule, for each condition, the limitation of match values

WAF policy custom rule, for each condition, the limitation of match values is 10 according to the document, but I can update through AzPowershell the match values to more than 10, will the match values that exceed the limit take effect?

Azure Web Application Firewall
asked 2025-11-17T02:37:24.4433333+00:00
Elisa 20 Reputation points
accepted 2025-11-19T01:42:20.14+00:00
Elisa 20 Reputation points
2 answers

How do I reduce the cost of a WAF to 0 without deleting it?

We are hibernating assets in Azure. How can I reduce the cost of a WAF to 0 without deleting it?

Azure Web Application Firewall
asked 2025-11-18T20:42:25.78+00:00
rowland hirst 0 Reputation points
answered 2025-11-18T22:14:35.39+00:00
Venkatesan S 925 Reputation points Microsoft External Staff Moderator
2 answers

Remove my IP from WAF default' blocklists

Hello, Since almost a month, it has become impossible for me to access a lot of different services that are behind WAF, including Netatmo's (smart home appliance manufacturer) servers. After reaching to Netatmo's customer supports, they told me that my…

Azure Web Application Firewall
asked 2025-11-07T16:52:52.19+00:00
Allan ELKAIM 0 Reputation points
edited a comment 2025-11-11T21:02:02.2266667+00:00
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Azure Web Application Firewall Bot Manager Rule set 1.1

Can we please have further information on the "Good Bots" detection with the rule set 1.1? Which AI crawlers would be identified as "Good Bots"? The main reason behind this is that we are managing a public facing website and are…

Azure Web Application Firewall
asked 2025-10-23T05:13:24.66+00:00
Ma, Le 20 Reputation points
accepted 2025-10-27T01:54:10.0933333+00:00
Ma, Le 20 Reputation points
0 answers

Azure WAF exclude specific content-type header

Hi community, I am trying to make an exclusion for a ruleid which is triggered for [REQUEST_HEADERS:Content-Type:application/scim+json; charset=UTF-8]}. It seems pretty straightforward: Match on RequestHeaderValues contains: scim+json However the rule…

Azure Web Application Firewall
asked 2025-09-19T08:56:07.43+00:00
eenchev 10 Reputation points
commented 2025-10-24T21:31:59.88+00:00
Camilo Santana 0 Reputation points
1 answer

Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement

Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement

Azure Web Application Firewall
asked 2025-10-23T09:54:12.9433333+00:00
Elisa 20 Reputation points
answered 2025-10-23T11:48:24.07+00:00
Priya ranjan Jena 2,295 Reputation points Microsoft External Staff Moderator
1 answer

Azure WAF best practice for specific rules

Hi, Looking for some very specific help regarding Azure Web application rules. Some URI'S are hitting various WAF rules within the OWASP Ruleset (using version 3.2 currently) and I am looking to exclude these from those specific rules (2 in question…

Azure Web Application Firewall
asked 2025-09-18T15:17:19.12+00:00
Eddie Vincent 245 Reputation points
answered 2025-10-17T12:07:48.5033333+00:00
Praveen Bandaru 9,245 Reputation points Microsoft External Staff Moderator
0 answers

Application gateway WAF can protect all attacks listed>

Hi all, May I confirm if WAF in Application gateway can protect from the attacks listed below? Buffer overflow SSI injection Directory Traversal I cannot find these in the document below. …

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,296 questions
Azure Web Application Firewall
asked 2022-12-01T13:54:38.593+00:00
Testa 571 Reputation points
commented 2025-10-08T02:02:25+00:00
Alfredzo Nash 0 Reputation points
2 answers

App Service cannot connect to Azure SQL Database despite firewall and VNet rules

We have an Azure App Service that is unable to connect to an Azure SQL Database. The following configuration steps have already been completed, but the issue persists: All App Service outbound IPs are added to the SQL Server Firewall and Virtual Networks…

Azure Web Application Firewall
asked 2025-10-01T07:49:23.57+00:00
Adel M 0 Reputation points
answered 2025-10-01T09:37:54.39+00:00
Harish Peddapally 1,670 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

Application Gateway with WAF performance degradation

We are very often experiencing crashes/performance degradation of our Application Gateway with associated WAF in detection mode. Throughput on the AGW is just about 100 req/s and it doesn't change much throughout the day (IoT devices requests, all across…

Azure Web Application Firewall
asked 2025-09-22T11:01:13.0233333+00:00
Martin Kutlák 20 Reputation points
commented 2025-09-29T07:47:08.9133333+00:00
Martin Kutlák 20 Reputation points
0 answers

Local ISP - New /23 IP Block Restricted by Azure - How to fix?

We are a local ISP in SE Oklahoma. We have a new /23 of ip's that are all experiencing the same blocks from Azure, the one website that we are aware of is activeandfitdirect.com, yet i assume there are others. When accessing the website from any of the…

Azure Web Application Firewall
asked 2025-09-25T20:14:55.7333333+00:00
CircleBWireless 0 Reputation points
commented 2025-09-25T21:08:16.48+00:00
TP 145.2K Reputation points Volunteer Moderator
2 answers

Rate limiting does not work

We are trying a custom rule: Rate 100 priority 100 hits 1 minute IP address range 0.0.00/255.255.255.255 The application goes rightaway into Forbidden 403 and never comes back

Azure Web Application Firewall
asked 2025-09-14T13:26:58.2033333+00:00
Todd Covert 0 Reputation points
commented 2025-09-17T04:39:19.9233333+00:00
Harish Peddapally 1,670 Reputation points Microsoft External Staff Moderator
1 answer

Rate Limit on Azure WAF Frontdoor Premium not working as expected

We have created an Azure Frontdoor Premim Tier with a Web Application Firewall associated with it and we are having some issues with a specific rule we created to apply rate limiting. The rule is looking for a specific URL and specifies a limit of 2 http…

Azure Front Door
Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
1,035 questions
Azure Web Application Firewall
asked 2024-03-19T14:55:39.86+00:00
Fabián Avilés 80 Reputation points
edited a comment 2025-09-17T02:43:09.9033333+00:00
Matthew Mckenzie 0 Reputation points
2 answers One of the answers was accepted by the question author.

Question on TLS 1.2 Enforcement Deadline (31-Aug) and Azure WAF Upgrade

Hi Community, We are currently preparing to upgrade our Azure Web Application Firewall (WAF) from V1 to V2 and transition all connections to TLS 1.2 in line with Microsoft’s enforcement deadline of 31 August. I would like to clarify a few points: What…

Azure Web Application Firewall
asked 2025-08-28T08:28:53.9566667+00:00
Nang Shwe Yea Oo 20 Reputation points
accepted 2025-09-03T08:26:34.85+00:00
Nang Shwe Yea Oo 20 Reputation points
1 answer

Clarification on Addition and Updates of Rules in Azure WAF Managed Rule Sets (OWASP CRS) and Impact on Exclusions

Hello Azure Support Team, We have some questions regarding the management and update process of Azure Web Application Firewall (WAF) managed rule sets, specifically around the OWASP Core Rule Set (CRS) versions: How are new rules added to the managed…

Azure Web Application Firewall
asked 2025-08-11T18:37:38.1233333+00:00
Amritpal Brar 0 Reputation points
edited an answer 2025-08-20T09:17:14.5333333+00:00
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator
1 answer

One of my home IP addresses can't access sites hosted in Azure

Hi, I have a slightly odd issue - traffic coming from my default home IP address (82.68.8.222) seems to be being dropped by some websites hosted on Azure (Microsoft learn, Nationwide Building Society). If I masquerade my laptops as coming from a…

Azure Web Application Firewall
asked 2025-04-06T11:21:58.96+00:00
Launchbury, Phil 0 Reputation points
commented 2025-08-18T15:34:37.0433333+00:00
Anonymous
1 answer One of the answers was accepted by the question author.

How can I find the original client IP address of a log entry in my WAF?

When I go into the logs for our Application Gateway and run a KQL query to see what items were caught (based on OWASP rules), I can see that the request logs have a column clientIp_s that shows the IP address of the requestee. However, the IP addresses I…

Azure Web Application Firewall
asked 2025-07-30T20:22:34.91+00:00
Josh Cantie 20 Reputation points
accepted 2025-07-31T12:48:27.7233333+00:00
Josh Cantie 20 Reputation points