@Clay Brinlee , Apologies for the delay in responding here.
You can do this by adding WAF to Application Gateway and use a custom rule.
Custom rules for Web Application Firewall v2 on Azure Application Gateway
Some samples of custom rules located here: Create and use Web Application Firewall v2 custom rules on Application Gateway -Kindly check out the steps.
Based on your requirement, you could go with the above approach. Or other approach with WAF on Azure Front Door could also be used.
Custom rules for Web Application Firewall with Azure Front Door
Just to provide you a good understanding on hosting website on Azure. Azure offers several ways to host websites: Azure App Service WebApps (PAAS solution), Virtual Machines (IAAS), Service Fabric and Cloud Services (/in your case) – It provides more control over the underlying infrature. On an Azure VM, you would typically perform the same steps/process as you would do on prem.
Please see this -https://learn.microsoft.com/azure/architecture/guide/technology-choices/compute-decision-tree for more details on that topic.