Protect applications without blocking legitimate journeys or leaving teams with invisible exceptions.
An effective control has a known scope, owner and verifiable effect. This page covers security architecture choices; WAF diagnosis and configuration reviews have their own service scopes.
YOUR CONTEXT
A managed rule may mistake a valid encoded parameter or JSON body for an attack. Disabling the rule globally restores access but removes protection from other requests. Identify the actual request, rule and field involved.
A rule match in detection mode does not prove a block. Equally, an application 403 may be wrongly blamed on WAF. Without URI, method, timestamp, request ID and inspection action, a change can target the wrong component.
A global role granted to unblock a pipeline or a service still publicly accessible despite a private endpoint weakens protection. Review inherited permissions, workload identities, DNS and the paths traffic actually takes.
THREE PILLARS
Azure Front Door inspects at the global edge and routes to multiple origins; Application Gateway WAF sits within a regional VNet architecture. Placement depends on TLS termination, traffic and visibility between proxies. Track managed rules and exclusions by version and test against representative traffic.
Limit roles to the required scope, separate deployment and operations, and prefer Managed Identities over static secrets where possible. A private endpoint is not enough: check residual public access, Private DNS zones and flows from applications and remote networks.
Azure Policy can observe or deny non-compliant configurations. Justified exemptions should be scoped, assigned and reviewed. Version and validate sensitive changes with rollback; fixing exposure must not introduce an outage.
TECHNICAL DECISIONS
Front Door and Application Gateway protect different points. Document TLS termination, origins, private paths and requests visible at each layer before deciding which component applied a rule or caused a block.
Correlate WAF logs and application responses to find the rule, request variable and journey. An exclusion limited to the right field preserves other controls, with justification, approval, review date and post-change monitoring.
Non-compliance may call for an identity, network or deployment fix rather than a permanent exemption. Test actual access using the identities concerned, then confirm remediation does not break authorized journeys.
TAKE ACTION
This page describes capabilities. Each service sets out its scope, deliverables and process.
AKITA / CONTACT
Tell me about the decision, affected systems and constraints. I'll help you identify the most useful next step.
