Share via

Does Azure App Gateway with WAF in prevention mode block the requests even if the rule action is set to log

mani 20 Reputation points
2025-05-08T10:30:28.5+00:00

I have noticed that Azure Application Gateway WAF is blocking requests even though the matched rule’s action is set to log in Prevention mode.

It seems that even with action set to log, the rule still adds to the anomaly score, and the request gets blocked if the score exceeds the threshold.

Is this expected behaviour? f yes, does this mean the only way to prevent this is to disable the rule or use an exclusion?

I couldn’t find clear documentation about this, so I would appreciate clarification.

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,185 questions
0 comments
Accepted answer
  1. Sindhuja Dasari 630 Reputation points Microsoft External Staff Moderator
    2025-05-08T11:49:48.3033333+00:00

    Hello mani

    I understand you're seeing some unexpected behavior with your Azure Application Gateway WAF. When using Azure Application Gateway with WAF in Prevention mode, the behavior depends on your rule set configuration:

    Default Behavior - Prevention mode will block requests that match WAF rules by default, regardless of the individual rule's action setting. The "Log" action in rule settings typically refers to logging the event, not overriding the mode's blocking behavior.

    Custom Rule Behavior - For custom rules specifically, if you set a custom rule's action to "Log", it will only log the request even in Prevention mode (won't block).

    But for managed rule sets (OWASP Core Rule Set), Prevention mode will block regardless of individual rule logging settings

    If you need to log without blocking for testing purposes, you should:

    • Switch to Detection mode temporarily, or
    • Create custom rules with Log action, or
    • Use rule exclusions for specific traffic patterns

    Please don’t forget to close the thread by clicking "Accept the answer" and "Yes" wherever the information provided helps you, as this can be beneficial to other community members.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.