How to configure Azure Application Gateway with WAF: step by step

João Barros 14 de August de 2026 4 min read

This guide shows how to configure an Azure Application Gateway with WAF (Web Application Firewall) to protect a public web application. It is useful because Application Gateway with WAF provides inspection at the HTTP(S) level, protects against known vulnerabilities (OWASP) and performs TLS offload.

Prerequisites

Azure account with permissions to create resources (Network Contributor and Contributor).
Azure CLI installed or access to the Azure Portal.
A public test Web App or VM (HTTP/HTTPS) — you can use a simple test page.

Step 1: Create a Resource Group

It is good practice to create a dedicated Resource Group. Here we use the Azure CLI; alternatively do it through the Portal.

az group create --name rg-appgw-waf --location westeurope

Step 2: Create the VNet and required subnets

The Application Gateway requires its own subnet. Also create a subnet for the application if it is a VM.

az network vnet create \
  --resource-group rg-appgw-waf \
  --name vnet-app \
  --address-prefix 10.0.0.0/16 \
  --subnet-name app-subnet --subnet-prefix 10.0.1.0/24

az network vnet subnet create \
  --resource-group rg-appgw-waf \
  --vnet-name vnet-app \
  --name appgw-subnet --address-prefix 10.0.2.0/24

Step 3: Create a Public IP for the Application Gateway

The Application Gateway needs a Public IP (static recommended) to serve public traffic.

az network public-ip create \
  --resource-group rg-appgw-waf \
  --name appgw-pip \
  --allocation-method Static \
  --sku Standard

Step 4: Create a Backend Pool pointing to your application

The backend can be a public IP, FQDN or internal resource. Here we use an example FQDN: mywebapp.example.com.

az network application-gateway create \
  --name appgw-waf \
  --location westeurope \
  --resource-group rg-appgw-waf \
  --sku WAF_v2 \
  --capacity 2 \
  --vnet-name vnet-app \
  --subnet appgw-subnet \
  --public-ip-address appgw-pip \
  --http-settings-cookie-based-affinity Disabled \
  --backend-pool-name backendPool \
  --backend-port 80 \
  --servers mywebapp.example.com

Step 5: Configure HTTPS (TLS) Listener — optional but recommended

For TLS you need a PFX certificate stored in Key Vault or uploaded. Here is an example with a local certificate via the Portal/Key Vault; via CLI is more complex. If you only use HTTP, you can omit this step.

# This step is usually done in the Portal: create HTTPS listener and associate PFX certificate
# Or use az network application-gateway ssl-cert create to upload a PFX
az network application-gateway ssl-cert create \
  --resource-group rg-appgw-waf \
  --gateway-name appgw-waf \
  --name sslCert \
  --cert-file /path/to/cert.pfx \
  --cert-password 'S3nh4!'

az network application-gateway http-listener create \
  --resource-group rg-appgw-waf \
  --gateway-name appgw-waf \
  --name httpsListener \
  --frontend-port 443 \
  --ssl-cert sslCert

Step 6: Enable and configure the WAF Policy

Create a WAF Policy to manage OWASP rules, detection/block modes and exemptions. By default use OWASP 3.2 and blocking in production.

az network application-gateway waf-policy create \
  --resource-group rg-appgw-waf \
  --name waf-policy-prod \
  --mode Prevention \
  --policy-settings file-upload-limit-in-mb=100

# Associate the policy with the Application Gateway
az network application-gateway update \
  --resource-group rg-appgw-waf \
  --name appgw-waf \
  --set wafConfiguration.enabled=true wafConfiguration.firewallMode=Prevention

# Or associate the created policy
az network application-gateway waf-policy update \
  --resource-group rg-appgw-waf \
  --name waf-policy-prod \
  --set policySettings.requestBodyCheck=true

Step 7: Test custom rules and exemptions

You can create rule exclusions (for example for upload fields) or custom rules if needed. Use tests with OWASP payloads to validate blocking.

az network application-gateway waf-policy managed-rule rule-set add \
  --resource-group rg-appgw-waf \
  --policy-name waf-policy-prod \
  --type OWASP --version 3.2

# To create an exclusion (example: exclude JSON field 'token')
az network application-gateway waf-policy custom-rule create \
  --resource-group rg-appgw-waf \
  --policy-name waf-policy-prod \
  --name AllowTokenField \
  --priority 100 \
  --rule-type MatchRule \
  --match-conditions "[{'matchVariables':[{'variableName':'RequestBody' }],'operator':'Contains','matchValues':['\"token\"']} ]" \
  --action Allow

Verify the result

1) Browse to the Application Gateway Public IP and load your application. 2) Test with OWASP payloads (e.g.: SQLi) to confirm that the WAF blocks when in Prevention. 3) In the Portal, check logs under Diagnostics (enable diagnostics to send to Log Analytics) and confirm blockedRequests.

Conclusion

You now have a basic Azure Application Gateway with WAF protecting your application, with optional TLS and a WAF Policy in Prevention mode. Recommended next steps: integrate logs with Log Analytics, automate with ARM/Bicep and tune managed rules according to false positives. Tip: start in Detection mode before switching to Prevention to fine-tune rules and avoid unwanted blocks.