DDoS Simulation Test via External WAF (Imperva) – Need to Notify Microsoft?

Denial-of-service and DDoS-style testing against Azure resources is governed by specific rules of engagement.

1. Direct, self-run DDoS/DoS tests are not permitted The penetration testing guidance explicitly states that Denial of Service (DoS) testing of any kind, including tests that determine, demonstrate, or simulate DoS, is strictly prohibited against Microsoft online services, regardless of authorization. This prohibition applies even if:
   • The traffic is generated as a “simulation,” and
   • The target is ultimately hosted on Azure, including when fronted by a third‑party WAF such as Imperva.
2. Supported way to test DDoS resilience To test DDoS resilience for Azure-hosted public endpoints, the supported approach is to use Microsoft‑approved DDoS simulation partners, as documented under Azure DDoS Protection simulation testing. These partners (for example, BreakingPoint Cloud, MazeBolt, Red Button, RedWolf) provide controlled simulations that comply with Microsoft’s rules of engagement and avoid violating the DoS prohibition. The security testing guidance reiterates that DoS simulations in Azure must follow the policies in Azure DDoS Protection simulation testing.
3. Notification/coordination with Microsoft
   • When using the approved DDoS simulation partners and following the Azure DDoS Protection simulation testing guidance, coordination with Microsoft is built into the supported process.
   • Running an independent DDoS simulation (even via an external WAF) that generates significant attack-like traffic toward Azure endpoints, outside of that approved process, falls under the prohibited DoS testing category and is not allowed rather than something that can be “pre‑approved” via a normal support ticket.
4. Platform detection and abuse handling Azure runs automated abuse detection on inbound and outbound traffic. Activity that resembles DDoS may be flagged, and Microsoft may, at its discretion, interrupt the activity even if it is part of a test. If legitimate testing that complies with the rules is ever flagged, the guidance is to respond to the abuse notification with authorization details and scope.

Summary:

• Self-managed DDoS/DoS simulations against Azure resources (including those behind Imperva) are not permitted under the penetration testing rules.
• To test DDoS resilience, use the Microsoft‑approved DDoS simulation partners and follow the Azure DDoS Protection simulation testing guidance; coordination with Microsoft is handled through that channel, rather than via an ad‑hoc support ticket for a custom DDoS test.

References:

• Penetration testing
• Tutorial: Azure DDoS Protection simulation testing
• Architecture strategies for security testing