/azure-web-application-firewall

name: azure-web-application-firewall
description: Expert knowledge for Azure Web Application Firewall development including best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring Front Door/App Gateway WAF rules, rate limits, geo/IP filters, CAPTCHA/bot defense, or OpenAI/APIM protection, and other Azure Web Application Firewall related development tasks. Not for Azure Application Gateway (use azure-application-gateway), Azure Front Door (use azure-front-door), Azure Firewall (use azure-firewall), Azure DDoS Protection (use azure-ddos-protection).
compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata:
  generated_at: "2026-11-08"
  generator: "docs2skills/1.0.0"

Azure Web Application Firewall Skill

This skill provides expert guidance for Azure Web Application Firewall. Covers best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:

• **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
• **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

Category Index

| Category | Lines | Description | |----------|-------|-------------| | Best Practices | L35-L43 | Best practices for configuring and tuning Azure WAF (Front Door & App Gateway), reducing false positives, using geomatch, and mitigating application-layer DDoS attacks. | | Decision Making | L44-L49 | Guidance on planning and migrating from legacy WAF configs to full WAF policies, and managing the lifecycle, upgrades, and versions of Azure WAF managed rule sets. | | Limits & Quotas | L50-L56 | Rate limiting and size quotas for Azure WAF (Front Door and Application Gateway), including default limits, how they’re enforced, and how to configure request/body/upload size thresholds. | | Security | L57-L79 | Configuring and tuning Azure WAF/Front Door/Application Gateway security: bot & DDoS rules, IP/geo restrictions, default/custom rules, CAPTCHA, exceptions/exclusions, log scrubbing, governance, and OpenAI API protection. | | Configuration | L80-L105 | Configuring Azure WAF (Front Door & App Gateway): custom/managed rules, geo/ASN filters, rate limits, bot & CAPTCHA/JS challenges, exclusions, responses, logging, metrics, and policy management. | | Integrations & Coding Patterns | L106-L115 | Using WAF with other Azure services: integrating logs with Sentinel/Log Analytics, automating incident response, investigating events, and protecting APIM/Azure OpenAI via Front Door WAF. | | Deployment | L116-L121 | How to deploy and manage Application Gateway WAF v2 using Bicep, ARM templates, Terraform, and upgrade existing WAF configurations to WAF policies. |

Best Practices

| Topic | URL | |-------|-----| | Apply best practices for Azure Front Door WAF | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-best-practices | | Tune Azure Front Door WAF rules and reduce false positives | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning | | Apply best practices for WAF on Application Gateway | https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices | | Use WAF for application layer DDoS protection | https://learn.microsoft.com/en-us/azure/web-application-firewall/application-ddos-protection | | Apply geomatch WAF rules to strengthen web app security | https://learn.microsoft.com/en-us/azure/web-application-firewall/geomatch-custom-rules-examples |

Decision Making

| Topic | URL | |-------|-----| | Migrate Azure Application Gateway WAF configs to full policies | https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/migrate-policy | | Plan Azure WAF managed ruleset lifecycle and upgrades | https://learn.microsoft.com/en-us/azure/web-application-firewall/ruleset-support-policy |

Limits & Quotas

| Topic | URL | |-------|-----| | Understand Azure Front Door WAF rate limits | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit | | Understand Azure WAF on Application Gateway limits | https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-faq | | Configure WAF request and upload size limits | https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits |

Security

| Topic | URL | |-------|-----| | Manage AI bot ruleset in Azure Front Door WAF | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/ai-bot-ruleset | | Configure Azure Front Door WAF CAPTCHA protection | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/captcha-challenge | | Configure WAF exception lists for Azure Front Door | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/front-door-exceptions | | Configure HTTP DDoS ruleset for Front Door WAF | https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/http-ddos-rules