What is Azure Web Application Firewall?
Azure Web Application Firewall (WAF) provides centralized protection for web applications against common attacks and vulnerabilities. WAF is based on the OWASP Core Rule Set and protects against SQL Injection, Cross-Site Scripting (XSS), and other web exploits, among others. The service is not run standalone but is deployed in front of or within Azure Application Gateway, Azure Application Gateway for Containers, or Azure Front Door; on Azure Content Delivery Network, WAF is currently available in preview.
WAF provides security at the infrastructure level without requiring changes to application code and offers both a Detection and a Prevention mode.
Key Features
- OWASP Core Rule Set: Microsoft-managed, pre-configured rules against the OWASP Top 10 security risks
- Custom Rules: Custom rules based on IP addresses, geo-location, request rate, or request attributes
- Bot Protection: Detection and blocking of malicious bots using Microsoft Threat Intelligence
- Rate Limiting: Protection against application-layer (Layer 7) attacks through request limits
- Central Management: WAF policies for multiple applications via Azure Firewall Manager, usable on Application Gateway and Front Door
Typical Use Cases
Compliance Requirements: Meeting PCI-DSS, HIPAA, or other compliance standards that require WAF protection for web applications.
API Protection: Securing REST APIs and GraphQL endpoints against injection attacks and abuse.
Multi-Region Protection: Global protection for applications behind Azure Front Door with unified security policies.
Benefits
- No Code Changes: Protection implemented at the infrastructure level
- Managed Rules: Microsoft continuously updates rule sets against new threats
- Monitoring: Integration with Azure Monitor and Log Analytics for security insights
- Flexible Deployment: Available on Application Gateway, Application Gateway for Containers, Front Door, and as a preview on CDN
Frequently Asked Questions about Azure Web Application Firewall
Where should I deploy WAF: Application Gateway or Front Door?
Application Gateway WAF is suitable for regional applications with VNet integration. Front Door WAF offers global edge protection with typically lower latency for distributed applications. For containerized workloads, Application Gateway for Containers is also available.
What is the difference between Detection and Prevention mode?
Detection mode logs detected attacks without blocking them and is suited for the initial rule-tuning phase. Prevention mode actively blocks requests identified as attacks.
How do I handle false positives?
You can create rule exclusions for specific request attributes, disable individual rules, or place custom rules with Allow actions before the managed rules. Log Analytics helps identify false positives.
Does WAF protect against DDoS attacks?
WAF protects against application-layer (Layer 7) attacks such as Slowloris or HTTP floods. For volumetric DDoS attacks at the network layer (Layer 3/4), Azure DDoS Protection is additionally required.
What does Azure Web Application Firewall cost?
WAF is not billed separately but as part of the underlying platform (Application Gateway or Front Door): there are fixed costs for the gateway instance or WAF profile plus consumption-based costs based on capacity units (compute, connections, throughput). Current prices are available on the official pricing page.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Web Application Firewall: from initial configuration and rule tuning to CI/CD pipeline integration to ongoing monitoring and incident response.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
