Detection mode is an Azure web application firewall (WAF) operating mode that monitors requests matching WAF rules and records the matches without blocking those requests. It provides a safe observation period before enforcing rules in prevention mode. section 3.3.1 section 3.3.2
Use detection mode after associating a WAF policy with Azure Application Gateway or Azure Front Door. Test intended application features with requests believed to be legitimate, then inspect WAF logs for false positives. Move to prevention mode only after addressing the false positives you find. section 3.3.3
A practical rollout sequence is:
- Create and associate a WAF policy with the application entry point, using managed rule sets such as OWASP-based rules or bot protection. section 3.3.1 section 3.3.2
- Keep the policy in detection mode while exercising legitimate application traffic and reviewing logged matches. section 3.3.3
- Correct identified false positives, then enable prevention mode to block requests that match the configured rules. section 3.3.1 section 3.3.3
- Continue monitoring after enforcement because new application features can introduce legitimate traffic that matches WAF rules. section 3.3.3
Detection and enforcement state are separate settings. A policy can be shown as disabled while its mode is Detection; switching to prevention requires setting the mode to Prevention and enabling the policy. On Application Gateway, prevention-mode blocking uses anomaly scoring, with requests at a cumulative score of 5 or more blocked. section 3.3.1 section 3.3.2
Create a Front Door policy in detection mode
Create an Azure Front Door WAF policy with the Premium_AzureFrontDoor SKU, set --disabled true, and set --mode Detection. The resulting policy settings show enabledState as Disabled and mode as Detection, allowing rule-match observation before enforcement. section 3.3.2
Listing 3.12 Creating a WAF policy for Azure Front Door
az network front-door waf-policy create --name AzFrontDoorWafPolicy #1 --resource-group myResourceGroup #2 --sku Premium_AzureFrontDoor #3 --disabled true #4 --mode Detection #5 #1 The name of the WAF policy #2 The resource group in which the WAF policy is deployed #3 The SKU of the WAF policy #4 Creates the WAF policy in the disabled state #5 Creates the WAF policy in the detection mode
This CLI listing shows the two independent initial settings: --disabled true prevents active enforcement, while --mode Detection records matching requests without blocking them. section 3.3.2
