Application gateways should have Web Application Firewall (WAF) enabled
Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. WAF provides centralized protection from common exploits and vulnerabilities such as SQL injections and Cross-Site Scripting.
Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions.
What this control checks
Application gateways must have a WAF configuration or a firewall policy
Common pitfalls
WAF disabled or not configured
Check if Web Application Firewall is disabled or not configured for Azure's Application Gateway.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Web Application Firewall (WAF) should be enabled for Application Gateway" (564feb30-bf6a-4854-b4bb-0d2d2d1e6c66); Prowler check network_application_gateway_waf_enabled (prowler azure --checks network_application_gateway_waf_enabled); PowerPipe controls azure_compliance.control.application_gateway_waf_enabled and azure_compliance.control.application_gateway_waf_uses_specified_mode.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_120; KICS query "WAF Is Disabled For Azure Application Gateway" (2e48d91c-50e4-45c8-9312-27b625868a72).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-5 (Denial-of-service Protection), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-03 (Representations of the organization's authorized network communication and internal and external network data flows are...).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-5 (Denial Of Service Protection), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-5 Denial-of-service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- SC-5 Denial Of Service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 7.10 Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway
- 5 Policy for Information System Audit (IS Audit)
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- SC-5 Denial Of Service Protection
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Application gateways should have 'HTTP2' set to 'Enabled'
- Gateway subnets should not have a network security group configured
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
- Virtual machines should have management ports closed
- Public IP addresses should not be listed in Shodan
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
application_gateway_waf_enabled - Checkov Check:
CKV_AZURE_120 - Powerpipe Controls:
azure_compliance.control.application_gateway_waf_enabled,azure_compliance.control.application_gateway_waf_uses_specified_mode - Prowler Check:
network_application_gateway_waf_enabled - Azure Policy Definition:
564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - KICS Query:
2e48d91c-50e4-45c8-9312-27b625868a72
Last reviewed: 2026-10-10