Azure Waf

Azure Web Application Firewall (WAF)

Azure WAF is an OWASP-aligned application-layer firewall available in two host services:

• Azure Front Door (Premium / Standard) — global, anycast, edge-tier, ideal for internet-facing apps and APIs that benefit from edge presence and built-in caching.
• Azure Application Gateway (WAF v2) — regional, integrated with backend pools, ideal for app-internal or VNet-bound workloads that already terminate on App Gateway.

When to use

Protecting public web applications and APIs from layer-7 attacks: SQLi, XSS, RCE patterns, automated scanners, credential stuffing, scraping, and bot abuse. Use this skill for host selection, policy authoring, exclusion tuning, and operational ownership.

Do not use this skill for layer 3/4 DDoS (azure-ddos-protection), east-west / non-HTTP traffic (azure-firewall), or non-HTTP protocols.

Pick the host

Rule of thumb: Internet-facing new build → Front Door Premium. Brownfield with existing App Gateway + sticky reasons → App Gateway WAF.

Approach

1. Start in Detection (audit) mode. Always. Two minimum weeks of production traffic (more for seasonal apps) before flipping to Prevention.

2. Apply Microsoft's Default Rule Set (DRS). Current generation is preferred over the older OWASP CRS for new deployments. Enable Bot Manager rule set on Premium for Front Door.

3. Authentication-aware rules first.

   • Rate limit anonymous endpoints (login, search, signup) — typical 100/min/IP for login.
   • Geo-block countries you don't serve, but allowlist VPN concentrators or partner regions.
   • JSON / JS challenge on suspicious bot scores (Premium) — silently filters headless browsers.

4. Tune exclusions iteratively. This is the core operational task and the reason most WAFs end up "in detection forever." Process:

   1. Pull Detection-mode hits from AzureDiagnostics / AGCWAFLogs.
   2. Group by rule ID + URI + parameter.
   3. Confirm legitimate traffic (e.g., a legit SOAP body with < characters, an API that legitimately includes SQL keywords).
   4. Add scoped exclusion for that rule on that URI/parameter — never disable the whole rule globally.
   5. Re-baseline weekly.

5. Promote to Prevention rule by rule, not all at once. Start with high-confidence, low-FP rules (RCE patterns, command injection). Hold off on chatty rules (XSS, protocol violations) until exclusions are stable.

6. Custom rules for business logic. Examples:

   • Block specific user agents in pen-test campaigns.
   • Allow a partner CIDR to bypass rate limits.
   • Require a specific header on internal APIs.
   • Geo-block all but expected countries for admin paths.

7. Logging & analytics. Send WAF logs to Log Analytics (and Sentinel). Build:

   • Top blocked rules + top false-positive candidates (work queue).
   • Geo distribution of blocked traffic.
   • Rate-limit hits per endpoint.
   • Bot manager classification trends.

8. Operational ownership. WAF without a named app-team owner regresses. Monthly:

   • Review new rule set updates from Microsoft (auto-applied by default; review log diffs).
   • Re-baseline exclusions after app deployments that change request shapes.
   • Validate Prevention coverage (no quietly-disabled rules).

9. Pair with DDoS Protection on the front-door public IP / App Gateway public IP. WAF is L7; DDoS is L3/4. Both, always, for high-value public workloads.

Guardrails

• Do not deploy in Prevention on day one. False-positive outage in business hours.
• Don't disable rules globally to chase a single FP. Use exclusions scoped to the URI / parameter / cookie / header that actually triggered.
• Geo-block is a coarse tool. Travelers, VPN users, mobile-carrier IPs all roam. Prefer rate-limit + bot manager + auth posture over hard geo-deny for end-user paths.
• Bot manager scores aren't binary. Use the score band model (low → JS challenge, medium → CAPTCHA, high → block). Hard-blocking middle bands hits real users.
• Rate limits per IP behind shared NAT (carrier, corporate) hit too many real users. Pair with cookie/session + size the limit accordingly.
• WAF in front of an API doesn't replace API auth/authz. It's defense-in-depth, not the primary control.
• Multiple WAFs in series (third-party CDN WAF + Azure WAF) double-tune everything and frustrate engineers. Pick one as authoritative.
• Default Rule Set updates can introduce new rules. Review changes quarterly so a rule update doesn't surprise-block production.

Common anti-patterns

• "Prevention day-one" — outage; team disables WAF entirely; never re-enables. Now you have nothing.
• "Disabled rule 942100 because one URI false-positives" — entire rule class off. Use exclusion.
• "Rate limit = 1000/min globally" — useless on login endpoints, painful on static-asset endpoints. Per-endpoint tuning.
• "Geo-block everywhere" — cuts customers, doesn't stop motivated attackers.
• "Bot manager set to block all 'medium' scores" — blocks legitimate browser variants and partner integrations.
• "WAF logs not in Sentinel" — invisible.
• "Same WAF policy for all 30 apps" — exclusions become impossible. One policy per app or app family.
• "Skipped Default Rule Set updates" — coverage stagnates while attacks evolve.

Example prompts

• Migrate a public e-commerce app from a third-party WAF to Azure Front Door Premium WAF — design and cutover plan.
• Build the exclusion-tuning workflow: log queries, weekly review, app-team approval.
• Author custom rules: rate-limit /login 30/min/IP, JS challenge /api/search on bot-score medium, geo-block all but US/CA on /admin.
• Promote a Detection-mode WAF policy to Prevention rule-by-rule with rollback triggers.
• Sentinel workbook: top blocked rules, top FP candidates, geo distribution, bot manager trends.
• Compare Front Door WAF vs App Gateway WAF for a regional banking app.
• Design WAF + DDoS + private-link backend for a Foundry-hosted AI API.

Microsoft Learn

• WAF overview: https://learn.microsoft.com/azure/web-application-firewall/overview
• Front Door WAF: https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview
• App Gateway WAF v2: https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview
• Default Rule Set: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-drs
• Bot Manager: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-configure-bot-protection
• Custom rules: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-custom-rules
• Exclusions: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-exclusion
• Rate limiting: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-rate-limit
• WAF logs and metrics: https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-monitor
• JS / JSON challenge: https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview