Configure Akamai WAF with Microsoft Entra External ID

Akamai provides a quick start wizard to help you onboard new hostnames and protect them with its WAF solution, called App & API Protector.

Ion Standard is an extra solution that improves application performance and optimizes content delivery on the Akamai platform.

To access the wizard, select Get Started > App & API Protector + Ion Standard. The initial screen displays the steps required to complete onboarding. Select Start to begin.

For more information, see the steps in Configure Akamai WAF in the Akamai documentation.

If you prefer an advanced approach, first create and configure a property in Property Manager. A property is a configuration file that tells our edge servers how to handle and respond to incoming requests from your end users.

To learn more, see What is a Property?. To create and configure a property, follow these steps:

Create and configure a property

1. Go to Akamai Control Center to sign in.
2. Navigate to Property Manager.
3. For Property version, select Standard or Enhanced TLS (recommended).
4. For Property hostnames, add a property hostname for your custom domain.
   Example: login.domain.com

Origin server property configuration settings

Use these settings for the origin server:

1. For Origin type, enter your origin type.
2. For Origin server hostname, enter your hostname.
   Example: yourafddomain.azurefd.net
3. For Forward host header, select Incoming Host Header.
4. For Cache key hostname, select Incoming Host Header.

Configure DNS

Create a Canonical Name (CNAME) record in your DNS, such as login.domain.com, that points to the Microsoft Edge hostname in the Property hostname field.

Configure Akamai Web Application Firewall

1. Go to Akamai Control Center to sign in.
2. Navigate to Security Configurations.
3. To create a new security configuration, select Protect existing property.
4. Enter a configuration name in Configuration Details, then select Create and activate the configuration on Production network.
5. To get started with the security configuration, see https://techdocs.akamai.com/cloud-security/docs/app-api-protector.
6. In a subsequent security configuration version, change the action under Web Application Firewall for Attack Group, and set Group Action to Deny.

WAF provider configuration

1. Sign in to the Microsoft Entra admin center as at least a Security Reader.
2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the external tenant you created earlier from the Directories + subscriptions menu.
3. Browse to Entra ID > Security Store.
4. Select the Protect apps from DDoS with WAF tile by selecting Get started.
5. Under Choose a WAF Provider select Akamai and then select Next.

6. Create an Akamai account. If you don’t have an account yet, create and purchase one in the Security Store. Then return here to complete the setup.
7. Under Configure Akamai WAF, you can select an existing configuration or create a new one. If you're creating a new configuration add the following information:
   • Configuration name: A name for the WAF configuration.
   • Host prefix: The host prefix from your Akamai EdgeGrid API credentials.
   • Client secret: The client secret from your Akamai EdgeGrid API credentials.
   • Access token: The access token from your Akamai EdgeGrid API credentials.
   • Client token: The client token from your Akamai EdgeGrid API credentials.

8. Select Next to go to the next step.

Domain verification

Select the custom URL domains that are enabled through Azure Front Door (AFD) to verify and connect them to your Akamai WAF configuration. This step ensures that the selected domains are protected with advanced security features.

1. Select Verify domain to start the verification process.
2. Select the custom URL domains you want to protect with Akamai WAF and then select Verify.

3. After verification, select Done to complete the process.

You can use the Microsoft Graph API through Graph Explorer to configure the Akamai WAF integration.

Make sure the caller has the Security Reader role and has consented to the RiskPreventionProviders.Read.All permission.

Step 1: Create Akamai WAF provider with the API

Make sure that you have the API client you created in Akamai. This information is required so the backend can call Akamai on your behalf to pull and verify the WAF configuration.

Request

The following example shows a request.

POST https://graph.microsoft.com/beta/identity/riskPrevention/webApplicationFirewallProviders
Content-Type: application/json
{
    "@odata.type": "#microsoft.graph.akamaiWebApplicationFirewallProvider",
    "displayName": "Akamai Provider Example",
    "hostPrefix": "akab-exampleprefix",
    "clientSecret": "akamai_example_secret_123",
    "clientToken": "akamai_example_token_456",
    "accessToken": "akamai_example_token_789"
}

Response

The following example shows the response. The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json
{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/riskPrevention/webApplicationFirewallProviders/$entity",
    "@odata.type": "#microsoft.graph.akamaiWebApplicationFirewallProvider",
    "id": "00000000-0000-0000-0000-000000000002",
    "displayName": "Akamai Provider Example",
    "hostPrefix": "akab-exampleprefix"
}

Step 2: Verify Akamai WAF provider with the API

The following example shows how to verify a webApplicationFirewallProvider using the hostName.

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProviderId}/verify
Content-Type: application/json
{
  "hostName": "www.contoso.com"
}

Response

The following example shows the response. The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json
{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.webApplicationFirewallVerificationModel",
    "id": "00000000-0000-0000-0000-000000000000",
    "verifiedHost": "www.contoso.com",
    "providerType": "akamai",
    "verificationResult": {
        "status": "success",
        "verifiedOnDateTime": "2025-10-04T00:50:26.4909654Z",
        "errors": [],
        "warnings": []
    }
}