6.3.1. WAF Deployment Options

Detection vs Prevention Mode:

Start in Detection mode, analyze logs, tune false positives, then enable Prevention.

Placement is the decision that actually matters, because it determines how far a malicious request travels before anything stops it. A WAF on Front Door runs at Microsoft's edge, so an attack is discarded near the attacker and never enters your network. A WAF on Application Gateway runs in your region, so the same request crosses the internet, reaches your virtual network, and is inspected there. Front Door is also where Microsoft has consolidated its content-delivery capabilities, so new global designs belong there rather than on a standalone CDN profile.

Why Detection first is not just caution. Managed rule sets are generic by design, and real applications routinely send traffic that looks like an attack — a CMS posting HTML, an API accepting SQL-like filter strings. Detection mode gives you the log of what would have been blocked so those rules can be excluded before anyone is turned away. Going straight to Prevention means discovering the false positives from customer complaints.

💡 First Principle: Match the WAF's scope to the application's scope. A regional application gains nothing from edge inspection; a global one loses most of the benefit without it.