Application Gateway Web Application Firewall policies should have request body inspection enabled
Ensure that Web Application Firewalls associated to Azure Application Gateways have request body inspection enabled. This allows the WAF to inspect properties within the HTTP body that may not be evaluated in the HTTP headers, cookies, or URI.
Request body inspection allows WAF to inspect the body of HTTP requests for potential threats. Enabling this feature enhances security by detecting attacks that may be hidden in request payloads.
What this control checks
Application Gateway WAF policies must have request body inspection enabled
Common pitfalls
Default effect is Audit
The effect parameter allows Audit, Deny, or Disabled, with a default of Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Web Application Firewall on Azure Application Gateway should have request body inspection enabled" (ca85ef9a-741d-461d-8b7a-18c2da82c666); PowerPipe control azure_compliance.control.web_application_firewall_policy_request_body_inspection_enabled.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 7.14 (Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.14 Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
web_application_firewall_policy_request_body_inspection_enabled - Powerpipe Control:
azure_compliance.control.web_application_firewall_policy_request_body_inspection_enabled - Azure Policy Definition:
ca85ef9a-741d-461d-8b7a-18c2da82c666
Last reviewed: 2026-10-15