Azure WAF Security Features in Standard Tier with Front Door

@Bhushan Gawale ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

As you mentioned, we have Custom-authored rules available in the Standard Tier.

This includes,

• IP allow list and block list
• Geographic-based access control
• HTTP parameters-based access control
• Request method-based access control
• Rate limiting rules
• Size constraint

You can find more examples here : Custom rules for Azure Web Application Firewall on Azure Front Door.

In addition to these, you also have "request body inspection" and "WAF custom response" .

To answer your question, everything above needs to be configured - i.e., they are not "default".

• But please note that "request body inspection" and "WAF custom response" are one step process in both Standard and Premium

Hope this adds more clarity

Cheers,

Kapil

Thanks for your response @KapilAnanth-MSFT Yes, that's correct, and I notice that different custom rules can be added in the standard tier. However, I'm curious about the value of the standard tier when customers opt not to create any custom rules.

For instance, what happens when the request body inspection setting is enabled? Is there any Microsoft documentation that specifies what it accomplishes once activated?

I would expect that any WAF should offer basic protection against common web vulnerabilities, such as XSS, SQL injection, and HTTP protocol violations.

If I assume that the standard tier inherently offers these basic protection services against web vulnerabilities, where can we access the logs? The WAF logs are only available in the premium tier.