Azure WAF: Front Door vs App Gateway, Pricing & Rules

Quick answer

Should you shortlist Azure Web Application Firewall?

Azure Web Application Firewall is most relevant for Azure workloads and Application Gateway users. Validate this main constraint before committing to a production design: Best fit is Azure-fronted traffic.

Deployment: Azure Application Gateway, Azure Front Door, Azure workloads
Pricing: Usage-based
License: Commercial service

Data card

Pricing: Usage-based
License: Commercial service
Deployment: Azure Application Gateway, Azure Front Door, Azure workloads
Integrations: Azure Monitor, Application Gateway, Front Door, Microsoft security tooling
Last checked: 2026-07-17

Best fit

Azure workloads
Application Gateway users
Front Door deployments

Potential limitations

Best fit is Azure-fronted traffic
Pricing and rule behavior should be modeled against the selected Azure entry point

WAFWiki read

Managed WAF for Azure Application Gateway and Azure Front Door.

This profile is written for evaluation rather than promotion. Use it to understand where Azure Web Application Firewall fits, which assumptions need validation, and which alternatives deserve side-by-side testing.

Evaluation checklist

Choose Front Door WAF, Application Gateway WAF, or both based on the real Azure traffic path.
Run detection mode and review diagnostics before enabling prevention mode.
Track managed rule false positives, exclusions, and custom rules in Azure Monitor.
Model cost, diagnostics retention, and rollback from prevention back to detection.

Product and architecture guide

How to evaluate Azure Web Application Firewall

Azure Web Application Firewall is not one interchangeable deployment. Front Door WAF protects a global edge path, while Application Gateway WAF protects a regional application delivery path. The correct choice follows the existing Azure architecture.

Front Door WAF and Application Gateway WAF solve different placement problems

Front Door is commonly evaluated for globally distributed HTTP traffic at the edge. Application Gateway is commonly evaluated for regional Layer 7 delivery inside an Azure architecture. Some systems use both, but each policy still needs a clear purpose.

Map DNS, TLS termination, origin routing, private networking, and regional boundaries before choosing.
Avoid copying exclusions between Front Door and Application Gateway without testing both paths.
Define which layer owns rate controls, custom rules, diagnostics, and incident response.

Use detection data before prevention mode

Managed rules and custom rules should be observed against representative traffic before prevention mode becomes the default. Azure diagnostics need to be enabled early enough to explain every rule match and exception.

Review login, upload, API, admin, and large request-body workflows.
Keep exclusions narrow and document the matched variable or parameter.
Confirm the team can query diagnostics and return to detection mode quickly.

Price the delivery service and WAF together

The WAF decision sits inside either Front Door or Application Gateway architecture. Capacity, traffic, policy, diagnostics, and retention assumptions should be modeled together instead of treating WAF as an isolated line item.

Estimate the selected entry point, traffic profile, WAF policy, and diagnostic retention together.
Separate architecture cost from the operational cost of tuning and reviewing alerts.
Use the same test application to compare both Azure paths when either could fit.

Implementation questions

Azure WAF implementation brief

Azure WAF is a policy layer inside an application-delivery architecture. Answer the placement, mode, diagnostics, and cost questions together before choosing a production path.

Decision question	Working answer	Evidence to verify
What is Azure WAF?	A managed Layer 7 protection capability used with Azure Front Door or Application Gateway. The two deployment paths share WAF concepts but protect different delivery boundaries.	Confirm the selected Azure service, tier, policy association, managed rule-set version, supported features, and production traffic path.
Front Door or Application Gateway?	Front Door fits a global edge entry and multi-region routing model. Application Gateway fits regional Layer 7 delivery, including virtual-network integration and regional backends.	Map DNS, TLS termination, origins, private networking, client identity, health checks, and bypass or rollback paths.
Detection or prevention mode?	Detection mode is the safer starting point for representative traffic. Prevention should follow diagnostics review, narrow exclusions, clean-workflow validation, and a tested mode rollback.	Collect rule-level diagnostics for login, upload, API, admin, and large-body flows and record every exclusion with an owner and review date.
What belongs in the cost model?	The delivery service, capacity or traffic, WAF policy, diagnostics ingestion, retention, alerting, and operating effort should be estimated as one architecture.	Compare current Front Door and Application Gateway pricing with measured traffic, scale behavior, log volume, retention, and operational ownership.

A product-specific CSV for Front Door or Application Gateway placement, policy mode, diagnostics, exclusions, cost, and rollback.

Download the Azure WAF evaluation checklist

Architecture decision

Azure WAF placement decision matrix

The right Azure WAF path follows the application delivery boundary. Use two WAF layers only when each layer has a distinct control objective and owner.

Workload scenario	Likely path	Evidence to verify
Global public web entry with multi-region origins	Azure Front Door WAF	DNS cutover, TLS, routing rules, origin health, cache behavior, client identity, and edge rollback.
Regional Layer 7 ingress into a virtual network	Application Gateway WAF	Listeners, backend pools, probes, private networking, certificates, diagnostics, and capacity behavior.
Front Door in front of Application Gateway	Layered policies with non-overlapping ownership	Which layer owns managed rules, rate controls, exclusions, logs, and emergency bypass without duplicate blocking.
API-heavy application	WAF attached to the actual API entry point	JSON bodies, authentication, methods, upload limits, rate patterns, API errors, and diagnostic context.

Azure WAF cost worksheet

Compare Front Door and Application Gateway as complete delivery architectures. WAF policy cost alone does not represent the production bill.

Entry service: Record the Front Door tier or Application Gateway sizing and the environments that need separate instances.
Traffic and capacity: Estimate requests, data processing, regions, peak behavior, scaling assumptions, and origin traffic.
Policies and controls: List managed rule sets, custom rules, bot or rate controls, exclusions, and duplicated layers.
Diagnostics: Include log categories, ingestion, workspaces, retention, queries, alerts, and security-platform export.
Operations: Account for detection review, exclusions, rule updates, incident response, and architecture rollback.

Evidence to collect before Azure WAF prevention mode

The evidence pack should explain both security behavior and the selected Azure delivery architecture.

A diagram showing DNS, TLS termination, Front Door or Application Gateway, private networking, origins, and bypass controls.
Detection-mode logs for representative login, upload, API, admin, and large request-body workflows.
An exclusion register naming the rule, variable, parameter, route, business reason, owner, and review date.
A side-by-side cost worksheet when either Front Door or Application Gateway could satisfy the entry requirement.
A tested rollback from prevention to detection and, where relevant, from the new traffic path to the previous route.

Feature snapshot

Azure Web Application Firewall capabilities to verify

Managed rulesCustom rulesBot protection optionsAzure-native logging

Comparisons

Azure Web Application Firewall alternatives and versus pages

Azure WAF vs AWS WAF

Research path

Continue the Azure Web Application Firewall evaluation

Azure WAF independent reviewReview Front Door and Application Gateway fit, diagnostics, rule operations, and alternatives.Application Gateway WAF pricing calculatorEstimate WAF_v2 gateway, capacity, data, diagnostics, networking, and operating cost.Azure WAF with Front Door evaluation guidePlan detection-mode rollout, diagnostics, clean workflows, exclusions, and rollback.Front Door WAF vs Application Gateway WAFChoose the inspection point from networking, traffic placement, ownership, and cost evidence.Azure WAF vs AWS WAFCompare native attachment points, rollout modes, diagnostics, pricing inputs, and operational boundaries.

FAQ

What is Azure Web Application Firewall best for?

Azure Web Application Firewall is commonly evaluated for Azure workloads, Application Gateway users, Front Door deployments.

Is Azure Web Application Firewall free?

Azure Web Application Firewall pricing path: Usage-based. Always verify current pricing on the official website.

Should I use Azure Front Door WAF or Application Gateway WAF?

Use the traffic path as the first criterion. Front Door is an edge-oriented global entry point; Application Gateway is a regional application delivery entry point. Validate networking, origin placement, diagnostics, and ownership before selecting.

What is the safest Azure WAF rollout mode?

Start with a controlled route and detection mode, review diagnostic logs and clean workflows, tune narrow exclusions, and move selected controls to prevention only after rollback has been tested.

Can Azure WAF protect API traffic?

Yes, when the API traffic passes through the selected Front Door or Application Gateway path. Validate JSON bodies, authentication, methods, request-size behavior, rate controls, and API-specific error handling before prevention mode.

Search WAFWiki

Azure Web Application Firewall WAF