canonical: https://jentic.com/apis/azure.com/azure-cdn-webapplicationfirewallmanagement

# Microsoft Azure Azure CDN WebApplicationFirewallManagement

The Azure CDN Web Application Firewall Management API configures WAF policies and managed rule sets attached to Azure CDN endpoints. It exposes operations to list, create, update, and delete CdnWebApplicationFirewallPolicies under Microsoft.Cdn, plus a discovery endpoint for the managed rule sets that ship with the service. Each policy bundles custom rules, managed rule sets, and rate-limit rules that Azure CDN evaluates on incoming HTTP requests.

## For AI agents

Manage Azure CDN Web Application Firewall policies and inspect available managed rule sets. Supports six endpoints for policy CRUD plus rule-set listing under Microsoft.Cdn.

## Scope

Does not configure Azure Front Door WAF, Application Gateway WAF, or DDoS Protection plans - use for Azure CDN WAF policies under Microsoft.Cdn only.

## Capabilities

- List the managed rule sets that can be attached to a CDN WAF policy
- Enumerate CdnWebApplicationFirewallPolicies in a resource group
- Retrieve a single WAF policy with its custom rules, managed rules, and rate-limit configuration
- Create or update a CDN WAF policy with custom rules and managed rule overrides
- Patch a policy's tags or enabled state without rewriting the full configuration
- Delete a CDN WAF policy that is no longer attached to any CDN endpoint

## Use cases

### Block Common Web Attacks at the CDN Edge

Attach a CDN WAF policy that includes a managed rule set covering OWASP Top 10 categories such as SQL injection and XSS, evaluated at the Azure CDN edge before requests reach origin servers. The Web Application Firewall Management API lets you create the policy, reference the managed rule set ID, and link the policy to one or more CDN endpoints. Most teams roll out a baseline policy across an entire CDN profile in under an hour.

Example prompt: Create a CdnWebApplicationFirewallPolicy named edge-baseline in rg-cdn that references the latest DefaultRuleSet managed rule set with action=Block.

### Rate-Limit Sensitive Endpoints

Throttle abusive traffic to login or checkout paths by adding rate-limit rules to a CDN WAF policy. The policy properties include a rateLimitRules array with matchConditions on RequestUri, plus thresholds in requests per minute. Once the policy is attached to a CDN endpoint, any client exceeding the threshold receives a 429 from the edge without ever hitting origin compute.

Example prompt: Update an existing CDN WAF policy to add a rate-limit rule on RequestUri Contains '/login' with rateLimitThreshold=100 and rateLimitDurationInMinutes=1.

### Geo-Block Traffic by Country

Deny CDN traffic from specific countries by adding a custom rule with a RemoteAddr or GeoMatch operator to a WAF policy. The API supports custom rules with priorities and explicit Allow or Block actions, evaluated before managed rule sets. Rolling out the change is a single PATCH or PUT against the policy resource, with effect propagating across the CDN footprint within minutes.

Example prompt: Update CdnWebApplicationFirewallPolicy edge-baseline to add a custom rule with name=GeoBlock, priority=10, action=Block, and matchCondition GeoMatch on the configured country list.

### Agent-Driven Policy Standardisation

A Jentic agent enumerates every CDN WAF policy across the tenant and patches each one to use the same managed rule set version, custom rules, and rate-limit configuration. The agent uses Policies_List to discover policies and Policies_CreateOrUpdate to converge them on a baseline, replacing manual portal review with deterministic enforcement.

Example prompt: List all CdnWebApplicationFirewallPolicies in subscription 1111-2222 and patch each policy whose managed rule set version is older than 1.0 to the latest available DefaultRuleSet version.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets | List available managed rule sets |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies | List CDN WAF policies in a resource group |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} | Get a single CDN WAF policy |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} | Create or update a CDN WAF policy |
| PATCH | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} | Patch tags or basic state of a policy |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} | Delete a CDN WAF policy |

## Key resources

- **CdnWebApplicationFirewallPolicies** — CRUD on CDN WAF policies with custom rules, managed rule sets, and rate limits
- **CdnWebApplicationFirewallManagedRuleSets** — Discovery of available managed rule sets and their rule groups

## Why Jentic

- **Setup:** Wiring Azure CDN WebApplicationFirewallManagement by hand means registering an Azure AD app, exchanging OAuth 2.0 tokens for management.azure.com, discovering managed rule set versions, and building the Azure Resource Manager plumbing that polls long-running policy updates and retries on throttling. Through Jentic you install once, import Azure CDN WebApplicationFirewallManagement from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This API puts the subscription, resource group, and policy name in the URL path (for example /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}), so a rule can pin your agent to a specific WAF policy. You choose the operations it may call, so ones like deleting a policy or overwriting it with a create-or-update are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an Azure CDN WAF policy with managed rules' or 'add a rate-limit rule to a WAF policy', and Jentic returns the matching Policies operation with its full schema, including the managedRules and rateLimitRules blocks, so the agent does not read ARM docs.

## Related APIs

- **Azure CDN Management** — Provisions CDN profiles and endpoints that this WAF API protects.
- **Azure Front Door Management** — Front Door is the alternative global edge with its own WAF resource provider.
- **Web Application Firewall Management** — Generic Microsoft.Network WAF policies for Application Gateway scenarios.

## FAQ

### What authentication does the Azure CDN WAF Management API use?

Azure Active Directory OAuth 2.0 via the azure_auth scheme (user_impersonation scope) on https://management.azure.com/. Through Jentic, the AAD app credentials live in your Jentic One instance and the agent receives a runtime bearer token, never the secret.

### Can I add a rate-limit rule with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} with a rateLimitRules array containing matchConditions, rateLimitThreshold (requests), and rateLimitDurationInMinutes.

### What are the rate limits for the Azure CDN WAF Management API?

It shares Azure Resource Manager subscription throttling, typically 12,000 reads and 1,200 writes per hour per subscription. The API itself manages WAF rate-limit rules; do not confuse those data-plane limits with the control-plane ARM throttling that affects how often you can update policies.

### How do I attach a managed rule set through Jentic?

Search Jentic for "create azure cdn waf policy", load the schema for Policies_CreateOrUpdate, populate the managedRules.managedRuleSets array with the desired ruleSetType and ruleSetVersion (discovered via ManagedRuleSets_List), then execute. Get an API key through Jentic One, the self-hosted execution layer.

### Does this API protect Azure Front Door endpoints?

No. This API targets Azure CDN endpoints under Microsoft.Cdn. Azure Front Door uses its own WAF resource provider, Microsoft.Network/frontdoorWebApplicationFirewallPolicies, which is exposed by a different API.

### Can a single policy be attached to multiple CDN endpoints?

Yes. A CdnWebApplicationFirewallPolicy can be referenced by multiple CDN endpoint resources, and changes to the policy propagate to every endpoint that links it. The policy resource tracks the linked endpoints via its endpointLinks property.

### Can I limit what my agent is allowed to do with the Azure CDN WAF Management API?

Yes. Because you run Jentic One yourself, your own rules decide which of this API's operations the agent may call, so you can grant read-only access like listing policies and managed rule sets while excluding destructive calls such as deleting a policy or overwriting it with a create-or-update. Since this API places the subscription, resource group, and policy name directly in the URL path, you can also pin the agent to one specific WAF policy or resource group rather than the whole subscription. The Azure AD credential stays in your Jentic One instance and is injected only at execution time, never exposed to the agent.