{"id":58641,"date":"2026-10-12T14:31:44","date_gmt":"2026-10-12T04:31:44","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/26\/how-azure-waf-custom-responses-improve-security-operations-safely\/"},"modified":"2026-10-12T14:31:44","modified_gmt":"2026-10-12T04:31:44","slug":"how-azure-waf-custom-responses-improve-security-operations-safely","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-azure-waf-custom-responses-improve-security-operations-safely\/","title":{"rendered":"How Azure WAF Custom Responses Improve Security Operations Safely"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post How Azure WAF Custom Responses Improve Security Operations Safely we will explain how to give legitimate users a useful response when Azure blocks them, while avoiding technical clues that help attackers test your defences.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">This problem is more common than many technology leaders realise. A customer submits a form, receives an unexplained 403 error and calls support. Meanwhile, an attacker receives the same response and studies every detail to learn what triggered the block.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The answer is not to expose more security information. It is to separate the simple message shown publicly from the detailed evidence available privately to your security and support teams.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Application Gateway WAF actually does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Application Gateway sits in front of a website or business application and directs incoming web traffic to the correct system. Its Web Application Firewall, usually shortened to WAF, inspects requests before they reach that system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The WAF uses Microsoft-managed security rules and rules created by your team. These can identify common attacks such as malicious database commands, harmful scripts, suspicious bots and requests from blocked locations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the WAF operates in prevention mode, it can stop a suspicious request instead of merely recording it. Azure normally returns a 403 Forbidden response with a basic blocked-request message. A custom response lets you replace that status and message at the WAF policy level.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This response is generated at the gateway. The malicious request does not need to reach your application, which reduces unnecessary processing and helps limit exposure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why the response message matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A vague technical error creates operational noise. Help desk staff may not know whether the application failed, a user lacks permission or the WAF blocked the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, an overly detailed response creates a different problem. It might reveal the rule number, matched text, security product, internal application name or request characteristic that caused the block.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker can use that feedback to make small changes and try again. It is similar to a burglar being told which alarm sensor detected them and exactly how sensitive it is.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A good response should therefore confirm that the request was not accepted without explaining how your detection worked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What a safe custom response should contain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For most customer-facing applications, a short response is enough:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Request blocked.\n\nWe could not process this request. If you believe this is an error,\ncontact support and provide the approximate time of the request.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This gives a genuine user a practical next step. Your support team can search internal records using the reported time, user, page and source address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The WAF rule ID or name.<\/li>\n<li>The text or request field that matched the rule.<\/li>\n<li>Internal hostnames, application names or network addresses.<\/li>\n<li>Database, framework or server details.<\/li>\n<li>Instructions for changing the request so it will be accepted.<\/li>\n<li>Detailed diagnostic information intended for administrators.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For most blocked requests, retaining the 403 status is sensible because it accurately tells browsers and monitoring tools that access was refused. A 429 response can be appropriate for a policy dedicated to rate limiting, which means controlling how many requests a user or system can make.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid returning a 200 success code for a blocked request, even though Azure supports it. That can mislead applications, monitoring platforms and business reports into treating a security block as a successful transaction.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to configure the response<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the Azure portal, open the WAF policy associated with your Application Gateway. Select <strong>Policy settings<\/strong>, locate the custom response section and enter the required block response status code and body.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The equivalent Azure CLI command can be kept in your deployment process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az network application-gateway waf-policy policy-setting update \\\n --resource-group rg-prod-network \\\n --policy-name waf-prod-portal \\\n --custom-status-code 403 \\\n --custom-body &quot;Request blocked. If you believe this is an error, contact support and provide the approximate request time.&quot;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Using deployment code rather than relying only on manual portal changes makes the configuration easier to review, test and reproduce. It also reduces the chance that production and disaster recovery environments display different behaviour.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure currently allows selected response codes, including 403, 405, 406 and 429, as well as several non-standard 99x codes. The response body can be up to 32 KB, and Application Gateway can have up to 20 WAF policies with custom block responses enabled. The body must be Base64 encoded when configured directly through the Azure Resource Manager API. Custom block responses are not currently supported by Application Gateway for Containers WAF.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Keep the public response simple and the internal logs detailed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The custom response should not become your troubleshooting system. Detailed investigation belongs in Azure Monitor and Log Analytics, where access can be restricted to authorised staff.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable Application Gateway access and firewall logs through Azure diagnostic settings. Resource-specific logging is generally the cleaner option because it sends WAF events into a dedicated table rather than mixing many Azure services into one large legacy table.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A simple Log Analytics query can show which rules and application paths are generating the most blocks:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AGWFirewallLogs\n| where Action == &quot;Blocked&quot;\n| summarize Blocks=count(),\n DistinctClients=dcount(ClientIp)\n by RuleId, RequestUri, bin(TimeGenerated, 15m)\n| order by Blocks desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Your team can then distinguish between an active attack, an automated scanner and a legitimate business process being blocked by mistake.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Alerts should focus on meaningful changes rather than every individual block. Examples include a sudden increase in blocked requests, repeated activity against a sign-in page or one source targeting many application paths.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This approach also supports stronger incident detection and response around internet-facing systems. It complements the Essential Eight, the Australian Government&#8217;s baseline set of cyber risk reduction measures, but it does not replace the broader controls required to achieve an Essential Eight maturity target.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services company running a customer portal through Azure Application Gateway. A managed WAF rule begins blocking some legitimate document submissions because certain form content resembles a database command.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With the default response, customers report that the portal is broken. The service desk sends the issue to the application team, which spends time checking servers and recent software releases before discovering the WAF block.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With a carefully designed custom response, the customer knows the request was rejected and provides the approximate time. The service desk follows a documented process, checks the WAF dashboard and identifies the affected rule and page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is faster diagnosis, fewer unnecessary escalations and less disruption for customers. The attacker still receives no useful information about the rule that detected the request.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not use custom responses to hide poor WAF management<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A friendlier error page does not fix false positives, which are legitimate requests incorrectly identified as attacks. Before moving a new policy into prevention mode, run it in detection mode so it records likely matches without blocking users.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review the results, tune overly broad rules and test important workflows such as sign-in, payment, document upload and application programming interface requests. Microsoft recommends tuning WAF policies before using prevention mode because detection mode alone records threats but does not stop them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If one Application Gateway hosts several applications, consider separate policies for different listeners or URL paths. A public website, customer API and administration portal may need different rules and response wording.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Remember that WAF is only one security layer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A WAF can inspect web requests, but it cannot solve every application risk. For example, an AI application may pass a technically valid request through the WAF and still receive a malicious instruction intended to manipulate the AI model.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If Application Gateway protects an AI service, combine it with the controls discussed in protecting OpenAI applications from prompt injection. AI agents also need restricted permissions so one unsafe instruction cannot affect the whole business, as explained in our guide to limiting the blast radius of an AI agent incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Make blocked requests easier to manage without explaining your defences<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The best WAF response is useful to a genuine customer, unhelpful to an attacker and backed by detailed internal monitoring. Keep the public message short, retain meaningful status codes and give support teams a documented way to find the real event.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc combines more than 20 years of enterprise IT experience with hands-on Azure, Microsoft Defender and Wiz expertise. As a Microsoft Partner and Wiz Security Integrator, we help organisations improve cloud security without turning every change into a large, expensive project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether your Application Gateway WAF is blocking the right traffic, exposing too much information or generating alerts nobody reviews, we are happy to take a look \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Azure WAF custom responses can reduce support confusion and improve incident handling without revealing rule details that help attackers refine their requests.<\/p>\n","protected":false},"author":1,"featured_media":58643,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[21,19,13],"tags":[],"class_list":["post-58641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure-monitor","category-azure-security","category-blog"],"jetpack-related-posts":[{"id":59313,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/22\/hardening-azure-front-door-waf-with-service-tag-match-conditions\/","url_meta":{"origin":58641,"position":0},"title":"Hardening Azure Front Door WAF with Service Tag Match Conditions","author":"CPI Staff","date":"October 22, 2026","format":false,"excerpt":"Service tag matching lets Azure Front Door Premium WAF control Azure service traffic without fragile IP lists. Learn how to scope, test and deploy these rules safely.","rel":"","context":"In &quot;Azure Security&quot;","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 1x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 1.5x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 2x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 3x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 4x"},"classes":[]},{"id":59390,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/25\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse\/","url_meta":{"origin":58641,"position":1},"title":"How Azure Front Door WAF Group-By Rate Limiting Stops Abuse","author":"CPI Staff","date":"October 25, 2026","format":false,"excerpt":"New group-by controls make Azure Front Door rate limiting more effective against distributed bots, abusive networks and expensive request floods without relying only on IP addresses.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png 1x, \/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png 1.5x, \/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png 2x, \/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png 3x, \/wp-content\/uploads\/2026\/10\/how-azure-front-door-waf-group-by-rate-limiting-stops-abuse.png 4x"},"classes":[]},{"id":59277,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/azure-application-gateway-keyless-tls-without-slowing-delivery\/","url_meta":{"origin":58641,"position":2},"title":"Azure Application Gateway Keyless TLS Without Slowing Delivery","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside protected hardware while Application Gateway handles secure traffic. Learn where it fits, what it changes and how to adopt it safely.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 2x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 3x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 4x"},"classes":[]},{"id":58491,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis\/","url_meta":{"origin":58641,"position":3},"title":"A Practical Azure Front Door Mutual TLS Playbook for B2B APIs","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how Azure Front Door mutual TLS can block unknown systems, strengthen partner API security, and reduce the operational risk of certificate-based B2B integrations.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 1x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 1.5x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 2x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 3x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 4x"},"classes":[]},{"id":59342,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/22\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys\/","url_meta":{"origin":58641,"position":4},"title":"Keyless TLS and Managed HSM A CIO Guide to Safer Private Keys","author":"CPI Staff","date":"October 22, 2026","format":false,"excerpt":"Keyless TLS protects a critical weak point in web security by keeping private keys inside protected hardware. Here is what CIOs should assess before adopting it.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 1x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 1.5x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 2x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 3x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 4x"},"classes":[]},{"id":59295,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/21\/how-keyless-tls-raises-the-bar-for-azure-web-application-security\/","url_meta":{"origin":58641,"position":5},"title":"How Keyless TLS Raises the Bar for Azure Web Application Security","author":"CPI Staff","date":"October 21, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside Managed HSM while Azure Application Gateway handles secure traffic. Learn where it adds value, what changes, and how to adopt it safely.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 1x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 1.5x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 2x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 3x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/08\/how-azure-waf-custom-responses-improve-security-operations-safely.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=58641"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58641\/revisions"}],"predecessor-version":[{"id":58642,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58641\/revisions\/58642"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/58643"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=58641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=58641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=58641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}