Overview of Azure Web Application Firewall features, deployment options, policy modes, managed and custom rules, and best practices to protect web applications from common attacks.
A Web Application Firewall (WAF) inspects and filters HTTP/HTTPS traffic before it reaches your backend applications, providing a dedicated layer of protection for web workloads. Properly configured, a WAF reduces exposure to common web attacks, centralizes enforcement, and simplifies security operations across distributed applications.Key benefits of using a WAF
Centralized protection
Apply consistent WAF policies in one place to protect multiple web applications and enforce a uniform security posture.
Simplified security management
Security teams can react to new threats once—by updating the WAF—without requiring coordination and code changes across many application teams.
Threat assurance
A WAF blocks common web attacks (SQL injection, cross-site scripting, malicious bots) before they reach your origins, lowering incident impact.
Rapid response
Centralized policy updates enable mitigation of zero-day vulnerabilities and emerging threats often faster than application patches.
Coverage of the OWASP Top 10
Built-in rules map to common vulnerabilities (injection, broken auth, sensitive data exposure, etc.), providing an immediate baseline defense when enabled. See the OWASP Top 10 for more detail: https://owasp.org/www-project-top-ten/
Azure WAF deployment optionsChoose a deployment model based on where you need inspection (region vs global edge), how you want to scope policies, and your overall architecture.
WAF on Azure Front Door
Deployed at Microsoft’s global edge, Front Door inspects incoming Internet requests close to users and before requests travel to origins. A single WAF policy can be applied across multiple Front Door endpoints, enabling global centralized enforcement across regions and hybrid environments. Learn more: https://learn.microsoft.com/azure/web-application-firewall/afds/overview
Global, multi-region apps, performance-sensitive global inspection
Control plane
Managed within region
Global management with edge delivery
Use cases
Internal or regional web apps behind VNets
Public-facing apps needing low-latency global protection
WAF policy modes
Detection (default)
The WAF evaluates incoming requests against its ruleset and logs suspicious activity without blocking traffic. This is the recommended starting mode so you can observe what would be blocked and fine-tune rules and exclusions.
Prevention
The WAF blocks requests that match configured rules or malicious signatures. After testing in detection mode, switch to prevention to actively enforce protections.
Example: If an attacker attempts SQL injection on a login form while the WAF is in prevention mode, the malicious request is blocked at the edge and never forwarded to your backend.
Managed rule sets and customization
Managed rule sets
Azure provides managed rule sets maintained by Microsoft that implement common protections, including mappings to OWASP-style protections. These rules are updated to address newly discovered threats.
Custom rules and exclusions
Create custom rules (block or allow) for IPs, geolocation, HTTP methods, header or cookie values, and URL path patterns. Use exclusions to prevent false positives for known benign requests or API clients.
Rate limiting and bot protection
Configure rules to mitigate abusive or automated traffic (throttling, bot detection, CAPTCHA/challenge behaviors).
Request inspection scope
Configure inspection for headers, query strings, cookies, and request bodies (body inspection is optional—be mindful of performance and payload size).
Policy scoping specifics
For Application Gateway: attach multiple policies per gateway to scope protections to different listeners/sites. For Front Door: one global policy can apply across multiple endpoints, simplifying global enforcement.
Common rule types and examples
Rule type
Purpose
Example
Signature-based
Block known attack patterns
SQLi or XSS signature match
IP restriction
Allow/deny traffic from IPs or ranges
Block malicious IP ranges
Geo-blocking
Block requests from specific countries
Deny requests from high-risk geographies
Rate-limiting
Throttle abusive request rates
Limit requests per minute per IP
Custom header rules
Enforce header-based access
Allow only specific API clients by header
Best practices for WAF deployment
Start in detection mode, analyze logs, and tune rules/exclusions before moving to prevention.
Use managed rules as a baseline, then add scoped custom rules for application-specific behavior.
Enable diagnostic logging and integrate WAF logs with your monitoring and SIEM pipelines.
Regularly review and update policies to respond to new threats and application changes.
Test changes in a staging environment or use a phased rollout to reduce the risk of blocking legitimate traffic.
Be cautious with full request body inspection—enable it only when necessary and size limits are appropriate.
Always validate WAF changes in a test environment or using detection mode before enforcing them in production. This reduces the risk of blocking legitimate traffic.
