Azure APRL and Custom Controls

WAF policies for Application Gateway and Front Door should be set to Prevention mode so that malicious requests are actively blocked rather than merely logged, providing real protection for web applications. This is a local custom check, not an automated APRL-mapped check or a universal Well-Architected Framework requirement; apply it according to your organization's baseline and workload requirements.

Remediation action:

1. In the Azure portal, navigate to the WAF policy (search for Web Application Firewall policies).
2. Select Policy settings in the left menu.
3. Under Mode, change the setting from Detection to Prevention.
4. Click Save.
5. Monitor WAF logs after switching to Prevention mode to identify any false positives and tune exclusion rules before they affect legitimate traffic.

Using Azure CLI (Application Gateway WAF): az network application-gateway waf-policy policy-setting update --policy-name <policy> --resource-group <rg> --mode Prevention

Related links

• Azure Web Application Firewall policy overview

%TestResult%