Module 00 — Introduction¶

Workshop Objectives¶

Welcome to the Azure Web Application Firewall (WAF) Workshop — 2026 Edition. This hands-on, self-paced program is designed to take you from foundational web-security concepts all the way through advanced WAF configuration, tuning, and monitoring in Azure.

Whether you are a security engineer hardening a production workload, a cloud architect designing a landing zone, or a SOC analyst investigating application-layer alerts, this workshop provides the knowledge and practical skills you need to protect modern web applications with Azure WAF.

What You Will Learn¶

After completing every module you will be able to:

• Explain the Azure WAF architecture and how it integrates with Application Gateway, Front Door, and Application Gateway for Containers.
• Create and manage WAF policies using the Azure Portal, Azure CLI, and Bicep/ARM templates.
• Configure and tune managed rule sets (DRS 2.1+) using anomaly scoring and exclusions.
• Build custom rules for rate limiting, geo-filtering, and application-specific logic.
• Enable bot protection with Microsoft Threat Intelligence and JavaScript Challenge.
• Monitor WAF activity with Azure Monitor, KQL queries, WAF Insights workbooks, and Microsoft Sentinel.
• Leverage Copilot for Security to accelerate threat investigation and incident response.
• Design reference architectures that integrate WAF with DDoS Protection, Azure Firewall, and Private Link.

Learning Path Overview¶

flowchart LR
    A[Security\nFundamentals] --> B[Azure WAF\nOverview]
    B --> C[WAF Policy &\nManaged Rules]
    C --> D[Custom Rules &\nBot Protection]
    D --> E[Platform\nDeployment]
    E --> F[Monitoring &\nCopilot]
    F --> G[Best Practices\n& Labs]

    style A fill:#6c757d,color:#fff
    style B fill:#0078d4,color:#fff
    style C fill:#0078d4,color:#fff
    style D fill:#0078d4,color:#fff
    style E fill:#0078d4,color:#fff
    style F fill:#0078d4,color:#fff
    style G fill:#28a745,color:#fff

Target Audience¶

This workshop is intended for technical professionals who design, deploy, or operate web application security in Microsoft Azure.

Prerequisites¶

Before you begin, make sure you have the following resources and knowledge:

Verifying Your Environment¶

# Verify Azure CLI version (≥ 2.61 required)
az --version | head -1

# Log in and set your subscription
az login
az account set --subscription "My Subscription Name"

# Verify the WAF extension is available
az network application-gateway waf-policy --help

# Verify Az module version (≥ 12.0 required)
Get-Module -Name Az -ListAvailable | Select-Object Version

# Log in and set your subscription
Connect-AzAccount
Set-AzContext -SubscriptionName "My Subscription Name"

# Verify WAF cmdlets are available
Get-Command *FirewallPolicy* -Module Az.Network

Workshop Agenda¶

The workshop is organized into fifteen progressive modules. Each module contains explanatory content followed by one or more hands-on labs. The table below provides a bird's-eye view of the entire curriculum.

Workshop Logistics¶

Lab Environment¶

• Labs deploy resources into your own Azure subscription. Estimated cost for a full run-through is under USD $20 if resources are deleted promptly after each lab.
• Each lab includes cleanup instructions to help you remove resources and avoid ongoing charges.
• Labs can also be run in a shared Azure Lab Services environment if provided by your organization.

Conventions Used in This Workshop¶

Source Code & Templates¶

All lab templates, Bicep files, and helper scripts are available in the repository's labs/ folder. Clone the repository before starting the labs:

git clone https://github.com/your-org/AzureWAF-Learning.git
cd AzureWAF-Learning/labs

Key Takeaways¶

References¶

• Azure WAF Documentation — Microsoft Learn
• Azure Cloud Shell — Microsoft Learn
• Azure Free Account
• Visual Studio Code — Azure Extensions