Need clarification on using Azure Application Gateway with WAF for an Azure Web App while retaining the default azurewebsites.net hostname

Question

Issue Summary

We are seeking clarification on whether Azure Application Gateway with WAF can be used as the public entry point for an Azure Web App while retaining the default Azure-provided azurewebsites.net hostname.

Issue Description

We have an Azure Web App that is currently intended to be accessed using the following URL:

https://nationalgrid-nobilltool.azurewebsites.net

Our target architecture includes Azure Application Gateway with WAF in front of the Web App. We would like to confirm whether Application Gateway can handle the incoming HTTPS traffic and provide WAF protection while users continue to access the application using the exact azurewebsites.net hostname.

Based on our current understanding, Application Gateway requires a listener associated with a hostname and HTTPS configuration, including an SSL certificate. We also understand that for Application Gateway to be the public entry point, the application hostname needs to resolve to the Application Gateway public IP, which may require a custom domain that we control.

Could Microsoft Support please confirm:

Can Application Gateway + WAF be placed in front of an Azure Web App while users continue to access it using the exact azurewebsites.net hostname?

Is a custom domain required for Application Gateway to act as the public entry point?

Can the default azurewebsites.net hostname be configured to resolve to or route through Application Gateway?

If this is supported, what is the recommended Microsoft-supported configuration for the Application Gateway listener, DNS, SSL certificate, and backend Web App?

If it is not supported, please confirm the reason and the recommended architecture when the requirement is to retain the azurewebsites.net URL while also requiring WAF protection.

Answer 1

@Foram Patel I hope you are doing well,

Welcome to Microsoft Q&A,

There is an important distinction here: the App Service *.azurewebsites.net hostname can be used as the backend hostname for Application Gateway.

However, if users must access the application using exactly https://nationalgrid-nobilltool.azurewebsites.net, the DNS for that Microsoft-owned hostname cannot be changed by the customer to point to the Application Gateway frontend. Therefore, Application Gateway cannot transparently become the public entry point for that exact hostname.

For a supported production architecture, Microsoft recommends using a custom domain for the public listener, pointing it to the Application Gateway frontend, and using the App Service *.azurewebsites.net hostname as the backend. Application Gateway can set the appropriate Host header when forwarding to App Service.

Microsoft documentation:

https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app

https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings

https://learn.microsoft.com/en-us/azure/application-gateway/how-application-gateway-works

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

Answer 2

No. Application Gateway can be the public entry point only when client DNS resolves the application host name to the Application Gateway frontend IP. For an App Service using the default *.azurewebsites.net host name, that host name is Azure-provided and not a DNS name that can be repointed to the Application Gateway frontend IP.

What is supported:

1. Application Gateway in front of App Service with a custom domain
   • Add an A record in the DNS zone that points the application host name to the Application Gateway frontend public IP.
   • Remove the existing CNAME that points directly to the web app.
   • Configure the Application Gateway listener for that host name and HTTPS.
   • Use WAF on Application Gateway for inspection and protection.
2. Application Gateway reaching App Service by its default backend host name
   • The backend App Service can still be accessed by Application Gateway using the default *.azurewebsites.net domain.
   • If redirects from App Service return the backend host name, a rewrite rule can rewrite the Location header to the Application Gateway host name.
   • Header rewrite is available only on Standard_v2 and WAF_v2.

What is not supported for the requirement stated:

• Keeping the exact public URL as nationalgrid-nobilltool.azurewebsites.net and making Application Gateway the public entry point.
• Configuring the default azurewebsites.net host name to resolve to the Application Gateway public IP.

Reason:

• Application Gateway accepts client traffic on its frontend IP through a configured listener.
• For internet-facing access, the application DNS name must resolve to that frontend public IP.
• The default azurewebsites.net name resolves as an Azure-controlled App Service name, not as a customer-controlled DNS name that can be redirected to Application Gateway.

Recommended Microsoft-supported architecture when WAF is required:

1. Use a custom domain for the public application URL.
2. Point that custom domain to the Application Gateway frontend public IP.
3. Configure an HTTPS listener on Application Gateway for that custom domain.
4. Enable WAF v2 and manage protection through WAF policies.
5. Keep the App Service as the backend, using either:
   • the same custom host name, or
   • the default *.azurewebsites.net backend host name, with header rewrite if needed for redirects.

If the requirement is to retain the exact azurewebsites.net public URL, the supported configuration in the provided material does not place Application Gateway as the public entry point for that same host name.

---

References:

• How to add application gateway to the azure web app service - Microsoft Q&A
• How an application gateway works
• Troubleshoot App Service issues in Application Gateway
• Secure your Azure Application Gateway