During WAF creation Default Ruleset 2.1 showing as in preview
While creating a new WAF policy for Regional WAF (Application Gateway), moving to the Managed rules tab to select the default ruleset, Microsoft_DefaultRuleSet_2.1 is showing (preview). I thought this was GA already? See below image. Thanks.
Azure Web Application Firewall
Updates to WAF OWASP 3.2 signatures
We are using OWASP 3.2 and we've been noticing a number of false positives occurring where they have not happened in the past, but we have not made changes to our application. This article states "These rule sets, managed by Azure, receive updates…
Azure Web Application Firewall
Azure Application Gateway WAF blocking some requests with OpenID Connect nonce cookies
The default rules of Azure Web Application firewall sometimes block requests containing a cookie set by Microsoft.AspNetCore.Authentication.OpenIdConnect During challenge redirect the AuthenticationHandler sets a cookie named:…
Developer technologies | ASP.NET | ASP.NET Core
Azure Web Application Firewall
Azure Web Application Firewall country mapping sudden increase in ZZs
I have a case on which our main metrics suddenly started to present an abnormal number of requests coming trough our WAF of ZZ requests, when these usually were a tiny percentage. The Geo location rules we use have been effective, but of course if all…
Azure Web Application Firewall
Repetitive GET request qurey in requestUri_s field of ApplicationGatewayFirewallLog
Hi, I am currently facing a strage behavior with Azure Application Gateway and WAF. We have a web application running in AKS connected to Application Gateway connected with AGIC. The application serves 2 hosts, let's say HostA and HostB. We found that…
Azure Web Application Firewall
Azure WAF bot protection ruleset. Meaning of log ID 300700
I have enabled bot protection ruleset for a waf policy. The DRS ruleset normally has a detailed message in the logs but for the bot protection I am finding it hard to identify the reason for a match for 300700 id Other bots (group Unknownbots). We have…
Azure Web Application Firewall
How would TLS inspection work with WAF enabled App Gateway and Azure Firewall?
Hi, I have been struggling with this from a while now. Our design has WAF enabled App gateway for incoming HTTP / HTTPS traffic from internet and then have Azure Firewall behind it. Have couple of queries for which I need assistance: 1: Does WAF has…
Azure Firewall
Azure Web Application Firewall
How to send different tenant's Azure WAF log to tenant with Sentinel Configured?
Hello, I have 2 tenants. A tenant : WAF configured (Sentinel x) B tenant : Sentinel configured( WAF x) I would like to analyze A's logs in tenant B's sentinel. How can I configure? I think I should configure Azure lighthouse, is it right? If not,…
Azure Lighthouse
Azure Web Application Firewall
Microsoft Security | Microsoft Sentinel
Azure Front Door WAF
We have an Azure Front Door instance with an attached Web Application Firewall (WAF)
Azure Web Application Firewall
Request URI Not Parsed in AGWFirewallLogs Query
When using a WAF, I tried to check the request URI before applying an exception because there were many detected logs. When querying AGWFirewallLogs, I extended the query using extend parseUrl = parse_url(RequestUri), but parseUrl appears empty. How can…
Azure Web Application Firewall
Azure Web Application Firewall- Microsoft_BotManagerRuleSet_1.0
This post is regarding the azure WAF unknown bots and its rules at the moment for us rule id 300700 'other bots' is being logging with errors for various API'S, i didn't see any information can anyone has more inputs on the existing issue will be…
Azure Web Application Firewall
Adding firewall in front of web apps in Hub-and-Spoke architecture
Hi, I am shifting towards hub & spoke model in my Azure subscription so that all the traffic coming into my subscription goes through the firewall. I have multiple types of resources but I am more concerned about web apps and function apps. How can…
Azure Front Door
Azure Firewall
Azure Virtual Network
Azure Web Application Firewall
Azure App Service
When to use Azure WAF or Azure Firewall ?
Hi Folks, Can anyone here please share some thoughts and comments of when to use Azure WAF or Azure Firewall? I have already existing Azure ExpressRoute so my Azure VMs can ping my OnPremise servers, and vice versa. My purpose here is to be able to…
Azure Firewall
Azure Web Application Firewall
Azure Firewall Manager

Clarification Needed on Azure WAF Ruleset Upgrade Notification for Non-Configured WAF Policy
I have recently received a notification from Azure urging me to upgrade to the latest Azure Web Application Firewall (WAF) ruleset version, specifically CRS 3.2 or DRS 2.1, by January 26, 2026. This is due to the deprecation of the older CRS 3.0 ruleset…
Azure Application Gateway
Azure Web Application Firewall
Integrate storage, database, webapp, and databricks into one VNET
We are hardening our ML platform in Azure. Basically, we want to put all the Azure services ( ADLS, PostgreSQL DB, Web App, and Databricks cluster) in one virtural network so all the traffic will be inside the Azure network whenever possible (except the…
Azure Virtual Network
Azure Databricks
Azure Web Application Firewall
Azure Database for PostgreSQL
Best Approach to Block Incoming Traffic During Initial Cache Loading in Azure VMSS
I am setting up a VMSS (Virtual Machine Scale Set) for a web application, and I need to perform an initial load of objects into the cache. To achieve this, I would like to open a web page on localhost to load the objects into the cache, but I don't want…
Azure Web Application Firewall
Azure Load Balancer
Windows for business | Windows Server | User experience | PowerShell
My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?
I have a bicep template defining App Gateway Web Application Firewall policy with exceptions. I am using api-version 2024-03-01…
Azure Application Gateway
Azure Web Application Firewall
How to Relax or Remove the “LocalRequestPartnerRateLimit” Rule in Azure Front Door?
We are hosting a web app on Azure App Service, with traffic routed through Azure Front Door. Most of the time, everything works smoothly. However, we occasionally get a 429 Too Many Requests error, and upon investigation, it appears that a rule named…
Azure Front Door
Azure Web Application Firewall
Azure | Azure Startups
Managing 200 Websites with Application Gateway and WAF Protection
Hello, I have a single server that is currently hosting over 200 websites. Is it possible to manage all these websites using an application gateway and protect them with a WAF?
Azure Application Gateway
Azure Web Application Firewall
Azure WAF Training
I have been working with a user who continually gets locked out of their acct, they state they have a script running thats "training the WAF" I was under the impression that a WAF is policy based and cant be trained like you would train an AI.…