Application Gateway WAF exceptions are in preview — here’s where they fit

Intro

Azure Application Gateway’s Web Application Firewall (WAF) has a new tool in its toolbox, exceptions are now in public preview. We already have other tools for allowing traffic: custom rules, exclusions, and disabling rules. Exceptions allow you to bypass WAF inspection for specific requests.

The four-tool comparison

Start by checking the WAF logs to confirm the false positive, then apply the right control.

Tool	Protection removed	How it works	When to use it
Exclusions	Minimal	Prevents specific request attributes from being inspected, while the rest of the request is still evaluated	For excluding a specific request attribute — a header, cookie, or parameter — that causes a false positive. Ideal for excluding the problematic data while letting WAF protect the rest of the request
Exceptions (preview)	Narrow	Bypass specific managed rules, rule groups, or whole rulesets for requests matching defined conditions	When legitimate requests trip false positives and you need to bypass specific rules for narrow cases without loosening the whole policy
Custom rules	Variable	Custom conditions, evaluated in priority order, to allow, block, log, or rate-limit requests before managed rules run	To enforce application-specific security requirements not covered by managed rules
Disabling rules	Broad	Changes that rule to Disabled, so it stops inspecting any request covered by the WAF policy, while other enabled rules are unaffected	Only for consistently confirmed false positives where no finer tool fits

Why exceptions are interesting

Unlike exclusions, which exclude specific request attributes from inspection, exceptions control which security rules are evaluated for matching requests.

In practice, that means you can keep a rule fully active for all traffic and skip it only for the narrow, identifiable requests that trip it falsely. For example, a specific API path like /api/search that legitimately sends payloads the SQLi rules flag — you scope the exception to that path, and the rule keeps protecting everything else.

Caveats

Choosing the right tool takes some evaluation. With exceptions specifically, expect to iterate: because they’re so narrow, you often end up discovering request by request what you need to open up — the rule stays fully active and keeps blocking everything else (assuming you’re running WAF in prevention mode).

The exceptions feature has some limitations that are important to know about.The current documentation provides details on theese.

• Each WAF policy supports up to 60 exceptions.

• An Application Gateway can have a total of 60 exceptions, regardless of how many WAF policies are associated with the gateway.

• Within a single exception, there are limits of 600 IP addresses, or 10 URIs, or 10 request headers.

Referances

• Microsoft Learn - Azure Application Gateway WAF exceptions list