Prevention mode is the blocking operating mode for an Azure web application firewall (WAF). Requests that match configured WAF rules are logged and blocked rather than merely observed. Use it after validating that legitimate application traffic will not be treated as malicious. section 3.3.1 section 3.3.2
Detection mode is the safer starting point: it logs matching requests without blocking them. Exercise intended application features with legitimate requests, investigate WAF logs for false positives, address them, and then switch to prevention mode. Continue monitoring after the switch because new application features can introduce legitimate traffic that matches a rule. section 3.3.3 section 3.3.3
For an Application Gateway WAF policy, enable prevention mode in this sequence:
- Create a WAF policy with a managed OWASP rule set and associate it with an Application Gateway v2. section 3.3.1
- Optionally add Microsoft-managed bot protection alongside the managed OWASP rule set. section 3.3.1
- Test in detection mode and review logged matches for false positives. section 3.3.3
- Set the policy state to Enabled and its mode to Prevention, then monitor WAF logs over time. section 3.3.1 section 3.3.3
On Azure WAF for Application Gateway, managed-rule matches use anomaly scoring. Rule severities contribute cumulative scores; in prevention mode, a request with a total score of 5 or greater is blocked. For example, matches scored 3 and 2 combine to reach the blocking threshold. This anomaly-scoring behavior is specific to Application Gateway WAF, not Azure WAF on Azure Front Door. section 3.3.1
Enable prevention on an Application Gateway policy
Update the named policy in its resource group with `--mode Prevention` and `--state Enabled`. The mode determines that rule-set matches are blocked; the state activates the WAF policy. section 3.3.1
Listing 3.11 Enabling a WAF policy for Application Gateway: Prevention mode
az network application-gateway waf-policy policy-setting update --policy-name my-waf-policy #1 --resource-group myResourceGroup #2 --mode Prevention #3 --state Enabled #4 #1 The name of the WAF policy #2 The resource group in which the WAF policy is deployed #3 The mode of the WAF policy; here, it is set to block incoming requests that match the rule set #4 The state of the WAF policy; here, it is set to enable the WAF policy
Use the Azure CLI command as a copyable policy-setting update: identify the WAF policy and resource group, then set both prevention mode and the enabled state. section 3.3.1
