Power Pages Web Application Firewall (WAF)

Source: Claude.ai chat (original: waf-benefits-and-traffic-blocking-rules__a3f76b51.md) Added: 2026-10-02

Summary

• Power Pages WAF is Azure Front Door WAF wrapped in the admin UI — managed rule sets (XSS, LRFI/RFI, protocol attacks) + a limited set of custom rules + logs. Runs in Prevention mode (blocks, doesn't just log).
• Included free with any paid Power Pages site capacity (not trial). No separate Azure Front Door bill — Microsoft provisions and pays for the profile. Logs land in a Dataverse table called "Power Pages log".
• Custom rules support geo / source IP / request URI matching + rate limits (1–5 min windows). Does NOT support blocking by domain, referrer, or user-agent — that must be approximated by IP range or rate limit.

Key takeaways

• Enable prerequisites: Power Platform admin role, production site (not trial), WAF toggled under Performance & protection or Security section in PPAC. Custom domains need a one-time TXT validation (minutes to 48 hrs).
• Breaking change: the old platform-level IP Restrictions feature stops working once WAF is on — rebuild any IP blocks as WAF custom rules.
• No detection-only mode — blocks from the moment it's switched on. Test in UAT site first; monitor the Power Pages log table for false positives from large query strings / unusual payloads.
• Not available in GCC / GCC High / DoD / China / UAE for custom rules.
• Day-one custom rules to add: geo-allow (CA/US) + rate-limit on login/registration URI.

Learnings / how to apply

• Standardize a "WAF-on" checklist in the Praxisis Sustain Operating Model: enable + add geo rule + add rate-limit on auth paths + schedule monthly log review (automate via a Power Automate flow that flags IPs with > N blocked hits).
• Add "legacy ADX / IP Restrictions migration" as a dedicated playbook step — the silent break on existing IP blocks is a production-impact gotcha.
• WAF-free pricing is a strong Praxisis Sustain story: when clients ask "what should we turn on this quarter at no extra cost?", WAF is a defensible answer.

---