Edit

Secure your Azure Application Gateway

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. As a critical component in your network infrastructure, Application Gateway handles incoming requests and routes them to backend services, making it essential to implement proper security measures to protect against threats and ensure compliance with organizational security requirements.

This article provides guidance on how to best secure your Azure Application Gateway deployment.

The security recommendations in this article implement Zero Trust principles: "Verify explicitly", "Use least privilege access", and "Assume breach". For comprehensive Zero Trust guidance, see the Zero Trust Guidance Center.

Network security

Network security for Application Gateway involves controlling traffic flow, implementing proper segmentation, and securing communications between clients and backend services.

  • Deploy a dedicated subnet: Place your Application Gateway in a dedicated subnet within your virtual network to provide network isolation and support the required infrastructure configuration. For more information, see Application Gateway infrastructure configuration.

  • Apply network security groups: Use network security groups (NSGs) to restrict traffic by port, protocol, source IP address, or destination IP address. Create NSG rules that allow required client, backend, and infrastructure traffic while limiting access from untrusted networks. For more information, see Network security groups.

  • Configure Application Gateway Private Link: Use Application Gateway Private Link to establish private connectivity to your gateway from clients across virtual networks, subscriptions, regions, and Microsoft Entra tenants without exposing traffic to the public internet. For more information, see Configure Azure Application Gateway Private Link.

  • Deploy Application Gateway without a public IP: Use a private-only Application Gateway deployment to remove the gateway's public IP address requirement, define a deny-all outbound NSG rule to prevent data exfiltration, and eliminate the inbound GatewayManager service tag dependency. For more information, see Private Application Gateway deployment.

  • Enable Azure DDoS Network Protection: Deploy Azure DDoS Network Protection on the virtual network that hosts your Application Gateway to help protect internet-facing applications from large-scale DDoS attacks with adaptive tuning and attack notifications. For more information, see Protect your application gateway with Azure DDoS Network Protection.

  • Configure private DNS for private endpoints: Link the required private DNS zones to the Application Gateway virtual network when backends or Key Vault certificates use private endpoints so the gateway resolves private IP addresses correctly. For more information, see DNS resolution in Azure Application Gateway.

Web application protection

Web Application Firewall (WAF) provides essential protection against common web vulnerabilities and attacks that target your applications.

  • Deploy Application Gateway WAF v2: Enable Azure Web Application Firewall on Application Gateway for internet-facing applications to protect against common attacks such as SQL injection and cross-site scripting. For more information, see What is Azure Web Application Firewall on Azure Application Gateway?

  • Manage WAF settings with WAF policies: Use WAF policies for Application Gateway WAF v2 instead of legacy WAF configuration so you can manage managed rules, exclusions, custom rules, and policy associations globally, per listener, or per URI. For more information, see Azure Web Application Firewall policy overview.

  • Use Default Rule Set (DRS) 2.2: Run DRS 2.2, the current highest available Default Rule Set version, preserve existing customizations when upgrading, and validate newly added enabled rules in log mode before allowing them to block traffic. For more information, see Upgrade CRS or DRS ruleset version.

  • Tune WAF before prevention mode: Start with detection mode to understand traffic patterns and tune false positives, then switch to prevention mode so WAF blocks malicious requests. For more information, see Best practices for Azure Web Application Firewall on Application Gateway.

  • Configure custom WAF rules: Create custom rules to address application-specific threats, including IP restrictions, geo-filtering, and request attribute matching that aren't fully covered by managed rule sets. For more information, see Create and use custom web application firewall rules.

  • Scope WAF exceptions narrowly: Use preview WAF exceptions only when false positives require bypassing inspection for specific requests, and scope exceptions to the narrowest practical rule, rule group, or managed ruleset. For more information, see Azure Application Gateway WAF exceptions list (preview).

  • Enable bot protection: Use the bot protection managed rule set with Application Gateway WAF v2 to classify and block malicious bots while allowing known good bots. For more information, see Azure Web Application Firewall on Azure Application Gateway bot protection overview.

  • Implement WAF rate limiting: Configure rate limiting custom rules to detect and block abnormally high request volumes from clients, geographies, or other session groupings. For more information, see Rate limiting overview.

Identity and access management

Proper authentication and authorization controls ensure only authorized users and systems can access Application Gateway and its configuration.

  • Configure mutual TLS authentication: Use mutual TLS authentication when applications require client certificate authentication at the gateway or certificate passthrough to the backend. For more information, see Mutual authentication overview.

  • Assign least-privilege Azure RBAC roles: Scope management access to the resource group or Application Gateway resource. Use the built-in Network Contributor role only for operators who need to manage network resources because there isn't an Application Gateway-specific built-in management role. For more information, see Azure built-in roles for networking.

  • Enforce Conditional Access for Application Gateway administrators: Apply Conditional Access policies that require multifactor authentication and compliant devices for identities that can create, modify, or delete Application Gateway, WAF policies, listener certificates in Key Vault, and the virtual network and public IP resources the gateway depends on. For more information, see Require MFA for Azure management.

  • Use managed identities for Key Vault certificates: Assign a user-assigned managed identity to Application Gateway and grant it access to retrieve Key Vault certificates or secrets, such as the Key Vault Secrets User role when Key Vault uses Azure RBAC. For more information, see TLS termination with Azure Key Vault certificates.

  • Apply resource locks to production gateways: Use resource locks to help prevent accidental deletion or modification of production Application Gateway and WAF policy resources. For more information, see Lock your resources to protect your infrastructure.

  • Review privileged access regularly: Run access reviews for groups and privileged identities that can administer Application Gateway, WAF policies, virtual networks, public IP addresses, and Key Vault certificates. For more information, see Create an access review of Azure resource roles in PIM.

Data protection

Data protection for Application Gateway focuses on securing data in transit and managing certificates and secrets properly.

Logging and monitoring

Logging and monitoring provide visibility into Application Gateway operations and help detect potential security threats.

  • Enable diagnostic settings: Configure diagnostic settings to collect Application Gateway access logs and WAF firewall logs in a destination such as Log Analytics, storage, or Event Hubs. Review the automatically collected activity log for control-plane changes. For more information, see Diagnostic logs for Application Gateway.

  • Use resource-specific log tables: Send logs to resource-specific tables such as AGWAccessLogs and AGWFirewallLogs to simplify queries and improve log discoverability. For more information, see Monitor Azure Application Gateway.

  • Configure security alerts: Create Azure Monitor alerts for failed requests, unhealthy hosts, capacity utilization, response status anomalies, and other signals that can indicate availability or security problems. For more information, see Monitor Azure Application Gateway.

  • Review WAF logs regularly: Analyze Application Gateway WAF logs to identify attacks, tune false positives, and confirm that prevention mode is blocking malicious requests as expected. For more information, see Azure Web Application Firewall monitoring and logging.

  • Send WAF logs to Microsoft Sentinel: Integrate WAF logs with Microsoft Sentinel or another SIEM so web application threats are correlated with signals from the rest of your environment. For more information, see Using Microsoft Sentinel with Azure Web Application Firewall.

  • Monitor backend health: Use backend health views and custom health probes to detect unhealthy backend servers and prevent traffic from being routed to failed or compromised instances. For more information, see View backend health through the portal.

Compliance and governance

Compliance and governance ensure your Application Gateway configurations are inventoried, monitored, and aligned with organizational policies.

  • Enforce configuration with Azure Policy: Use built-in Azure Policy definitions to audit and enforce Application Gateway and WAF configurations. Key policies include Azure Application Gateway should be deployed with Azure WAF, Web Application Firewall (WAF) should be enabled for Application Gateway, Web Application Firewall (WAF) should use the specified mode for Application Gateway, and Bot Protection should be enabled for Azure Application Gateway WAF. For more information, see Azure Policy built-in definitions for Azure networking services.

  • Tag gateway resources consistently: Apply tags to Application Gateway, WAF policies, public IP addresses, and related networking resources so ownership, environment, and compliance scope are clear. For more information, see Tag resources, resource groups, and subscriptions for logical organization.

  • Inventory gateway resources with Azure Resource Graph: Query Application Gateway, WAF policy, public IP address, and virtual network resources to identify configuration drift and unsupported patterns at scale. For more information, see What is Azure Resource Graph?.

Backup and recovery

Application Gateway doesn't provide a data-plane backup feature for the gateway itself. Recovery planning focuses on preserving configuration, protecting certificates and WAF policy definitions, and designing resilient traffic paths.

  • Define gateway configuration as code: Store Application Gateway, listener, rule, backend, public IP address, and related network configuration in Bicep, ARM templates, Terraform, or another infrastructure-as-code system so you can redeploy consistently after accidental deletion or regional failure. For more information, see Quickstart: Direct web traffic with Azure Application Gateway - Bicep.

  • Export existing configurations for recovery: Export production Application Gateway configurations to ARM templates when you create resources manually, then review and parameterize the templates before using them for recovery. For more information, see Export templates from the Azure portal.

  • Deploy zone-redundant Application Gateway v2: Use Application Gateway v2 with availability zone support in regions that support zones to improve resilience to zonal failures. For more information, see Scaling Application Gateway v2 and WAF v2.

  • Design cross-region traffic recovery: Use global routing services such as Azure Front Door or Azure Traffic Manager in front of regional Application Gateway deployments when applications require cross-region failover. For more information, see Use Azure Application Gateway with Azure Traffic Manager.

  • Version WAF policy configuration: Keep WAF policy definitions, custom rules, exclusions, and managed ruleset choices in source control so you can restore known-good policy versions and reapply tuning after rule set updates. For more information, see Best practices for Azure Web Application Firewall on Application Gateway.

  • Protect certificate recovery dependencies: Include Key Vault certificates, secret references, managed identity assignments, and Key Vault access permissions in recovery plans so restored gateways can retrieve TLS certificates. For more information, see TLS termination with Azure Key Vault certificates.

Next steps

  • Last updated on