How to block blacklisted resources in WAF (Azure Front Door / Application Gateway)?

Hi @K Sec Greg ,

Thank you for submitting your question on the Microsoft Q&A forum, and for taking the time to speak with me today.

I understand that the custom rules you tried were insufficient for this specific scenario, and I’ve shared additional details that should help refine your WAF configuration. I hope we can continue the discussion until you’re fully confident in the protection in place.

Please feel free to reach out anytime, either here or directly, if you or any other WAF customers have further questions or concerns. I’d be happy to help.

Thanks, Yuval

Update on Dec 19, 2025: Microsoft Support Team, backend engineering team are working on this issue (an associated SR created in Nov, 2025, and escalated recently). Per meeting, current custom-rules are insufficient, that is, AZ Waf failed to block blacklisted resources.

Hi K Sec Greg,

Thanks for posting question in Microsoft Q&A forum,

It sounds like you want to block specific endpoints in your Azure Front Door Web Application Firewall (WAF) due to security concerns. You can achieve this by creating custom rules in your WAF policy. Here's a step-by-step guide to help you set it up:

1. Access Azure Portal: Navigate to the Azure portal and find your Azure Front Door service.
2. Create or Modify WAF Policy:
   • If you don’t have a WAF policy yet, you’ll need to create one. You can follow the Create a WAF policy for Azure Front Door by using the Azure portal guide.
   • If you already have a policy, click on it to modify.
3. Custom Rules:
   • Go to the "Custom rules" section within your WAF policy.
   • Add a new custom rule and define the match conditions. For your case, select the option to match against the request URI.
   • Set the condition to block requests if the URI matches /conf/users.xml or /debug/script.
4. Set the Action: Choose "Block" as the action for the rule you’re creating.
5. Priority Setting: Assign a priority to your new rule. Remember, lower numbers have higher priority, so ensure it's set appropriately so that it gets triggered before any other rules that might conflict.
6. Save and Deploy: After configuring your rules, save the WAF policy and deploy the changes.
7. Testing: Test the endpoints to ensure that they are blocked as intended.

This will ensure that any requests to those specific endpoints are blocked by your Azure Front Door WAF, providing you the immediate protection you need until you can apply application-level patches.

References:

• Overview: What is Azure web application firewall for Azure Front Door?
• Custom rules for web application firewall with Azure Front Door
• Create a WAF policy for Azure Front Door

If you have further questions or need more details about any specific step, feel free to ask!

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.