NOTE: The table of exclusions below is only applicable to customers who use Prevention mode. When the firewall is in Detection mode, which is the default, we do not need to configure any of these rules.

From: https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview

Application Gateway WAF can be configured to run in the following two modes:

• Detection mode – When configured to run in detection mode, Application Gateway WAF monitors and logs in all threat alerts to a log file. Logging diagnostics for Application Gateway should be turned on using the Diagnostics section. You also need to ensure that the WAF log is selected and turned on. When running in detection mode web application firewall does not block incoming requests.
• Prevention mode – When configured to run in prevention mode, Application Gateway actively blocks intrusions and attacks detected by its rules. The attacker receives a 403 unauthorized access exception and the connection is terminated. Prevention mode continues to log such attacks in the WAF logs.

Prevention Mode Rule Configuration

Using prevention mode for the application gateway firewall, we must first add these exclusions:

FIELD	OPERATOR	SELECTOR
Request attribute name	Equals	SPHostUrl
Request attribute name	Equals	SPSiteUrl

With those exclusions in place, the following WAF rules need to be disabled:

Rule ID	Description	Justification
931130	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link	Needed to save app settings via /api/config/saveappsettings
941320	Possible XSS Attack Detected - HTML Tag Handler	Need to disable this rule otherwise need to add exclusion for EVERY field name (such as Comments, ReusableHTML, BodyText etc) HTML is passed via rich text fields.
942110	SQL Injection Attack: Common Injection Testing Detected	We modeled our API on SharePoint, which allowed special chaaraters that trigger this rule. However, SQL injection is n/a – we do not have a database.
942130	SQL Injection Attack: SQL Tautology Detected.	We modeled our API on the SharePoint search API (https://docs.microsoft.com/en-us/sharepoint/dev/general-development/sharepoint-search-rest-api-overview), which allows special characters that trigger this rule. However, SQL injection is n/a – we do not have a database and run through the medium of the SharePoint API.
942200	Detects MySQL comment-/space-obfuscated injections and backtick termination
942260	Detects basic SQL authentication bypass attempts 2/3
942300	Detects MySQL comments, conditions and ch(a)r injections
942330	Detects classic SQL injection probings 1/2
942340	Detects basic SQL authentication bypass attempts 3/3
942370	Detects classic SQL injection probings 2/2
942430	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)