409 questions with Azure Web Application Firewall tags

Sort by: Updated
1 answer One of the answers was accepted by the question author.

Getting "ApplicationGatewayFirewallNoRedisCacheRateLimitUnsupported" when I deploy. Which regions actually support this feature?

The organization where I work are attempting to diversify from North and West Europe. When attempting to deploy to Denmark East as a test, I'm getting the error "ApplicationGatewayFirewallNoRedisCacheRateLimitUnsupported", from which I…

Azure Web Application Firewall
asked 2026-07-16T11:13:42+00:00
Kristian K. Riisgaard 20 Reputation points
commented 2026-07-16T14:55:26.2366667+00:00
Kristian K. Riisgaard 20 Reputation points
1 answer One of the answers was accepted by the question author.

Front Door WAF rate-limit rule: groupBy 'None' rejected with "allowlisted for Developer Preview" error

I'm deploying an Azure Front Door Standard WAF policy via Bicep (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2024-02-01, sku Standard_AzureFrontDoor) with a RateLimitRule custom rule that uses groupBy: [{ variableName: 'None' }] to share…

Azure Web Application Firewall
asked 2026-07-14T21:07:35.04+00:00
Oscar Pairazaman 20 Reputation points
accepted 2026-07-16T12:52:12.5466667+00:00
Oscar Pairazaman 20 Reputation points
1 answer

Azure Application Gateway WAF – Rule 930120 (OS File Access Attempt) exclusion not working for JSON body key, even after confirming policy binding

Environment Azure Application Gateway v2, WAF_v2 SKU WAF Policy: Managed Rules, Microsoft_DefaultRuleSet version 2.1 Backend: Keycloak Admin Console (/admin/realms/{realm}/ui-ext endpoint), request body is application/json Diagnostic logs via…

Azure Web Application Firewall
asked 2026-07-16T06:40:58.8+00:00
Hannah Hsiung (熊偲涵) 0 Reputation points
answered 2026-07-16T06:41:28.27+00:00

AI answer

1 answer

Traffic Block OutSide Canada

I have created WAF rule that traffic allowed only from Canada, block rest of the country. Still we are getting traffic from outside countries, especially from US.

Azure Web Application Firewall
asked 2026-07-02T14:53:18.4033333+00:00
Joby Chacko 0 Reputation points
answered 2026-07-15T07:47:53.8833333+00:00
Christos Panagiotidis 3,546 Reputation points
4 answers

Azure WAF JSChallenge- SameSite=Strict cookie breaks replay POST mechanism

The Application Gateway WAF JSChallenge feature sets the appgw_azwaf_jsclearance cookie with SameSite=Strict, which prevents the cookie from being sent on the replay POST after challenge completion. This causes users to see a 403 error after successfully…

Azure Web Application Firewall
asked 2026-05-22T13:04:36.3566667+00:00
akram 0 Reputation points
answered 2026-06-24T12:48:07.9733333+00:00
Trier, Jakob 0 Reputation points
2 answers

Inconsistent Geo-blocking Behavior in WAF Policies with Prevention Mode

We have experienced inconsistent behavior between Application Gateway WAF Policies that were provisioned at different times and in different methods--e.g., manually in the Azure Portal or via Terraform--but are otherwise identically configured. Both are…

Azure Web Application Firewall
asked 2026-06-16T12:36:56.8766667+00:00
RJ 0 Reputation points
commented 2026-06-23T14:43:12.2133333+00:00
RJ 0 Reputation points
2 answers One of the answers was accepted by the question author.

Azure Application with WAF SKU return error 500 after WAF is enabled

My application is hosted behind Azure Application Gateway WAF and uses a legacy Thai character encoding (Windows-874) in query string parameters. The application has been working successfully since the beginning of the app gateway provisioning and the…

Azure Web Application Firewall
asked 2026-06-17T15:27:40.07+00:00
Sawachol Rojanaporn 60 Reputation points Microsoft Employee
accepted 2026-06-19T09:01:20.7133333+00:00
Sawachol Rojanaporn 60 Reputation points Microsoft Employee
1 answer

WAF custom rule for rate limiting only blocking every other request once limit is reached.

This is the rule that is being applied: This is an example of the output: Notice that the status codes alternate between 401 and 429. The rule is kicking in but does not persist. There are other articles that indicate others are observing this…

Azure Web Application Firewall
asked 2026-02-17T22:32:04.48+00:00
Steven Bruce 5 Reputation points
commented 2026-06-18T11:55:04.7333333+00:00
Himanshu Arora 0 Reputation points
1 answer

Geo location rule not working as expected

I HAVE GEO LOACTION BLOCK RULE IN WAF TO BLOCK NON-US traffic ,but it is blocking US ip address also

Azure Web Application Firewall
asked 2026-06-03T09:39:35.9833333+00:00
Nancharaiah Konatham 0 Reputation points
answered 2026-06-05T13:48:18.2666667+00:00
Vallepu Venkateswarlu 10,510 Reputation points Microsoft External Staff Moderator
0 answers

Need JA4 enabled on our Front Door WAF

How do we Enable JA4 / ClientFingerprint feature flag? I turned on Developer support but that only pushed me to post here/.

Azure Web Application Firewall
asked 2026-05-18T19:38:40.49+00:00
EricInIT-1 31 Reputation points
commented 2026-05-20T22:10:05.25+00:00
Vallepu Venkateswarlu 10,510 Reputation points Microsoft External Staff Moderator
1 answer

Enable JA4 / ClientFingerprint feature flag

I need to submit a ticket to enable the JA4 fingerprint feature on my Front Door WAFs

Azure Web Application Firewall
asked 2026-05-18T19:32:01.9866667+00:00
Matt Thomas 5 Reputation points
commented 2026-05-18T20:19:59.6566667+00:00
Matt Thomas 5 Reputation points
3 answers One of the answers was accepted by the question author.

WebApplicationFirewallPolicy validation failed. Subscriptions without DeveloperPreview flag enabled cannot use Microsoft_DefaultRuleSet_2.2

Attempting to create or update WAF premium policy with DRS 2.2 and I get the error in title. I cannot find what feature to register either in the portal or in powershell/CLI - Nothing references DefaultRuleSet.

Azure Web Application Firewall
asked 2025-12-04T03:47:01.5833333+00:00
Justin M. Szwed 35 Reputation points
commented 2026-04-29T12:31:24.06+00:00
Scott Rudy 41 Reputation points
1 answer One of the answers was accepted by the question author.

Rest API reference document for application gateway WAF was missing

My customer need to update/create their WAF rule using REST API. Previously there is the reference document…

Azure Web Application Firewall
asked 2026-04-21T05:31:02.16+00:00
lalitavw 20 Reputation points Microsoft Employee
accepted 2026-04-28T06:26:04.2766667+00:00
lalitavw 20 Reputation points Microsoft Employee
1 answer

How to enable JA4 feature for Azure FrontDoor WAF?

Bicep template mentioned JA4 matchVariable is available. https://learn.microsoft.com/en-us/azure/templates/microsoft.network/frontdoorwebapplicationfirewallpolicies?pivots=deployment-language-bicep#matchcondition However, it returns "Operator…

Azure Web Application Firewall
asked 2026-04-16T07:18:34.7633333+00:00
Pui Wong 0 Reputation points
commented 2026-04-17T04:43:48.6633333+00:00
Venkatesan S 10,260 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

WAF Rule Exclusion Not Working for FIX Rule Group Rule 943110 in Microsoft_DefaultRuleSet_2.1

Hi Community, I have configured a rule exclusion on our Azure Front Door WAF policy but the rule continues to fire despite the exclusion being in place for several hours. Looking for help understanding if this is a known limitation or a bug. Setup: …

Azure Web Application Firewall
asked 2026-04-07T17:10:36.0633333+00:00
Poorwa Kunwar 20 Reputation points
accepted 2026-04-08T20:05:27.9433333+00:00
Poorwa Kunwar 20 Reputation points
3 answers

google web bots deny by microsoft waf

We are getting reports that google web crawlers are getting blocked by azure waf. I am not seeing anything blocked in the logs although google is claiming it is being blocked. The web crawler testing yeilds that google crawler is allowed although from…

Azure Web Application Firewall
asked 2026-03-24T20:08:35.39+00:00
Darrin Werre - Azure Admin 0 Reputation points
answered 2026-03-28T18:51:47.6966667+00:00
Praveen Bandaru 11,720 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

Intermittent IPv6 Connection Hangs/Timeouts to Azure Front Door Endpoints (t-msedge.net) on Windows 11 and Linux

I am experiencing consistent connectivity issues when accessing websites hosted on the Microsoft Azure edge network (specifically endpoints like part-0016.t-0009.t-msedge.net) over IPv6. The connection hangs indefinitely during data transfer, while IPv4…

Azure Web Application Firewall
asked 2026-03-12T19:39:31.82+00:00
Jakub Kahoun 25 Reputation points
accepted 2026-03-17T13:20:17.8333333+00:00
Jakub Kahoun 25 Reputation points
2 answers

How to restrict /admin path access to VPN users while keeping the rest of the application publicly accessible?

I have an application hosted behind an Azure Application Gateway with WAF enabled and accessible through a public domain. The requirement is: The main application (e.g., https://example.com) should be accessible to everyone on the internet. The…

Azure Web Application Firewall
asked 2026-03-04T17:41:34.54+00:00
Hariprasath Durairaj 0 Reputation points
answered 2026-03-05T01:18:26.94+00:00
Praveen Bandaru 11,720 Reputation points Microsoft External Staff Moderator
3 answers One of the answers was accepted by the question author.

Allow ICMP over Azure APPGW - Firwall

Hello colleagues, We are using an Internet breakout solution which looks like below: Internet > AzureFw > Azure APPGW > LB > IPS > Azure vnet that contains Backends on which WebApps are being hosted, one of this applications for…

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

1,390 questions
Azure Web Application Firewall
asked 2023-01-04T13:46:41.327+00:00
Anonymous
commented 2026-02-24T20:23:34.4366667+00:00
Sujay Kumar J 0 Reputation points
1 answer

Multipart request body failed strict validation and Failed to parse request body while trying to upload files using multi-formdata

Trying to upload a file using the below code var multipartContent = new MultipartFormDataContent { { new StringContent("hrishi"), "createdBy" }, { new StringContent("hrishi"),…

Azure Web Application Firewall
asked 2023-04-03T13:26:11.3366667+00:00
T T, Hrishikesh (Cognizant) 0 Reputation points
commented 2026-02-21T00:25:40.5833333+00:00
Dickson Souza 0 Reputation points