You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| {tenant} | Yes | Name of your [Azure AD B2C tenant](tenant-management-read-tenant-name.md#get-your-tenant-name). If you're using a [custom domain](custom-domain.md), replace `tenant.b2clogin.com` with your domain, such as `fabrikam.com`. |
60
60
| {policy} | Yes | The user flow or policy that the app runs. Specify the name of a user flow that you create in your Azure AD B2C tenant. For example: `b2c_1_sign_in`, `b2c_1_sign_up`, or `b2c_1_edit_profile`. |
61
61
| client_id | Yes | The application ID that the [Azure portal](https://portal.azure.com/) assigned to your application. |
62
-
| nonce |Yes| A value included in the request (generated by the application) that is included in the resulting ID token as a claim. The application can then verify this value to mitigate token replay attacks. The value is typically a randomized unique string that can be used to identify the origin of the request. |
62
+
| nonce |Recommended| A value included in the request (generated by the application) that is included in the resulting ID token as a claim. The application can then verify this value to mitigate token replay attacks. The value is typically a randomized unique string that can be used to identify the origin of the request. |
63
63
| response_type | Yes | Must include an ID token for OpenID Connect. If your web application also needs tokens for calling a web API, you can use `code+id_token`.|
64
64
| scope | Yes | A space-separated list of scopes. The `openid` scope indicates a permission to sign in the user and get data about the user in the form of ID tokens. The `offline_access` scope is optional for web applications. It indicates that your application need a *refresh token* for extended access to resources. The `https://{tenant-name}/{app-id-uri}/{scope}` indicates a permission to protected resources, such as a web API. For more information, see [Request an access token](access-tokens.md#scopes). |
65
65
| prompt | No | The type of user interaction that you require. The only valid value at this time is `login`, which forces the user to enter their credentials on that request. |
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/partner-web-application-firewall.md
+91-49Lines changed: 91 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: martinco
7
7
ms.reviewer: kengaderdus
8
8
ms.service: azure-active-directory
9
9
ms.topic: how-to
10
-
ms.date: 01/26/2024
10
+
ms.date: 10/29/2024
11
11
ms.author: gasinh
12
12
ms.subservice: b2c
13
13
@@ -17,12 +17,9 @@ ms.subservice: b2c
17
17
18
18
# Tutorial: Configure Azure Active Directory B2C with Azure Web Application Firewall
19
19
20
-
Learn how to enable the Azure Web Application Firewall (WAF) service for an Azure Active Directory B2C (Azure AD B2C) tenant, with a custom domain. WAF protects web applications from common exploits and vulnerabilities.
20
+
Learn how to enable the Azure Web Application Firewall (WAF) service for an Azure Active Directory B2C (Azure AD B2C) tenant with a custom domain. WAF protects web applications from common exploits and vulnerabilities such as cross-site scripting, DDoS attacks, and malicious bot activity.
21
21
22
-
>[!NOTE]
23
-
>This feature is in public preview.
24
-
25
-
See, [What is Azure Web Application Firewall?](../web-application-firewall/overview.md)
22
+
See [What is Azure Web Application Firewall?](../web-application-firewall/overview.md)
26
23
27
24
## Prerequisites
28
25
@@ -32,77 +29,122 @@ To get started, you need:
32
29
* If you don't have one, get an [Azure free account](https://azure.microsoft.com/free/)
33
30
***An Azure AD B2C tenant** – authorization server that verifies user credentials using custom policies defined in the tenant
34
31
* Also known as the identity provider (IdP)
35
-
* See,[Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md)
36
-
***Azure Front Door (AFD)** – enables custom domains for the Azure AD B2C tenant
37
-
* See,[Azure Front Door and CDN documentation](../frontdoor/index.yml)
32
+
* See [Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md)
33
+
***Azure Front Door premium** – enables custom domains for the Azure AD B2C tenant and is security optimized with access to WAF managed rulesets
34
+
* See [Azure Front Door and CDN documentation](../frontdoor/index.yml)
38
35
***WAF** – manages traffic sent to the authorization server
39
-
*[Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/#overview)
36
+
*[Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/#overview) (requires Premium SKU)
40
37
41
38
## Custom domains in Azure AD B2C
42
39
43
-
To use custom domains in Azure AD B2C, use the custom domain features in AFD. See,[Enable custom domains for Azure AD B2C](./custom-domain.md?pivots=b2c-user-flow).
40
+
To use custom domains in Azure AD B2C, use the custom domain features in Azure Front Door. See [Enable custom domains for Azure AD B2C](./custom-domain.md?pivots=b2c-user-flow).
44
41
45
-
> [!IMPORTANT]
46
-
> After you configure the custom domain, see [Test your custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain).
42
+
> [!IMPORTANT]
43
+
> After you configure the custom domain, see [Test your custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain).
47
44
48
45
## Enable WAF
49
46
50
-
To enable WAF, configure a WAF policy and associate it with the AFD for protection.
47
+
To enable WAF, configure a WAF policy and associate it with your Azure Front Door premium for protection. Azure Front Door premium comes optimized for security and gives you access to rulesets managed by Azure that protect against common vulnerabilities and exploits including cross site scripting and Java exploits. The WAF provides rulesets that help protect you against malicious bot activity. The WAF offers you layer 7 DDoS protection for your application.
51
48
52
49
### Create a WAF policy
53
50
54
-
Create a WAF policy with Azure-managed default rule set (DRS). See,[Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md).
51
+
Create a WAF policy with Azure-managed default rule set (DRS). See [Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md).
55
52
56
53
1. Sign in to the [Azure portal](https://portal.azure.com).
57
-
2. Select **Create a resource**.
58
-
3. Search for Azure WAF.
59
-
4. Select **Azure Web Application Firewall (WAF)**.
60
-
5. Select **Create**.
61
-
6. Go to the **Create a WAF policy** page.
62
-
7. Select the **Basics** tab.
63
-
8. For **Policy for**, select **Global WAF (Front Door)**.
64
-
9. For **Front Door SKU**, select between **Basic**, **Standard**, or **Premium** SKU.
65
-
10. For **Subscription**, select your Front Door subscription name.
66
-
11. For **Resource group**, select your Front Door resource group name.
67
-
12. For **Policy name**, enter a unique name for your WAF policy.
68
-
13. For **Policy state**, select **Enabled**.
69
-
14. For **Policy mode**, select **Detection**.
70
-
15. Select **Review + create**.
71
-
16. Go to the **Association** tab of the Create a WAF policy page.
72
-
17. Select **+ Associate a Front Door profile**.
73
-
18. For **Front Door**, select your Front Door name associated with Azure AD B2C custom domain.
74
-
19. For **Domains**, select the Azure AD B2C custom domains to associate the WAF policy to.
75
-
20. Select **Add**.
76
-
21. Select **Review + create**.
77
-
22. Select **Create**.
54
+
1. Select **Create a resource**.
55
+
1. Search for Azure WAF.
56
+
1. Select the **Azure Service Web Application Firewall (WAF) from Microsoft**.
57
+
1. Select **Create**.
58
+
1. Go to the **Create a WAF policy** page.
59
+
1. Select the **Basics** tab.
60
+
1. For **Policy for**, select **Global WAF (Front Door)**.
61
+
1. For **Front Door SKU**, select the **Premium** SKU.
62
+
1. For **Subscription**, select your Front Door subscription name.
63
+
1. For **Resource group**, select your Front Door resource group name.
64
+
1. For **Policy name**, enter a unique name for your WAF policy.
65
+
1. For **Policy state**, select **Enabled**.
66
+
1. For **Policy mode**, select **Detection**.
67
+
1. Go to the **Association** tab of the Create a WAF policy page.
68
+
1. Select **+ Associate a Front Door profile**.
69
+
1. For **Front Door**, select your Front Door name associated with Azure AD B2C custom domain.
70
+
1. For **Domains**, select the Azure AD B2C custom domains to associate the WAF policy to.
71
+
1. Select **Add**.
72
+
1. Select **Review + create**.
73
+
1. Select **Create**.
74
+
75
+
### Default Ruleset
76
+
77
+
When you create a new WAF policy for Azure Front Door, it automatically deploys with the latest version of Azure-managed default ruleset (DRS). This ruleset protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats. Because Azure manages these rule sets, the rules are updated as needed to protect against new attack signatures. The DRS includes the Microsoft Threat Intelligence Collection rules that are written in partnership with the Microsoft Intelligence team to provide increased coverage, patches for specific vulnerabilities, and better false positive reduction.
78
+
79
+
Learn more: [Azure Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md#default-rule-sets)
80
+
81
+
### Bot Manager Ruleset
82
+
83
+
By default, the Azure Front Door WAF deploys with the latest version of Azure-managed Bot Manager ruleset. This ruleset categorizes bot traffic into good, bad, and unknown bots. The bot signatures behind this ruleset are managed by the WAF platform and are updated dynamically.
84
+
85
+
Learn more: [What is Azure Web Application Firewall on Azure Front Door?](../web-application-firewall/afds/afds-overview.md#bot-protection-rule-set)
86
+
87
+
### Rate Limiting
88
+
89
+
Rate limiting enables you to detect and block abnormally high levels of traffic from any socket IP address. By using Azure WAF in Azure Front Door, you can mitigate some types of denial-of-service attacks. Rate limiting protects you against clients that were accidentally misconfigured to send large volumes of requests in a short time period. Rate limiting must be configured manually on the WAF using custom rules.
90
+
91
+
Learn more:
92
+
-[Web application firewall rate limiting for Azure Front Door](../web-application-firewall/afds/waf-front-door-rate-limit.md)
93
+
-[Configure a WAF rate-limit rule for Azure Front Door](../web-application-firewall/afds/waf-front-door-rate-limit-configure.md)
78
94
79
95
### Detection and Prevention modes
80
96
81
-
When you create WAF policy, the policy is in Detection mode. We recommend you don't disable Detection mode. In this mode, WAF doesn't block requests. Instead, requests that match the WAF rules are logged in the WAF logs.
97
+
When you create a WAF policy, the policy starts in **Detection mode**. We recommend you leave the WAF policy in **Detection mode** while you tune the WAF for your traffic. In this mode, WAF doesn't block requests. Instead, requests that match the WAF rules are logged by the WAF once logging is enabled.
98
+
99
+
Enable logging: [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md#logs-and-diagnostics)
82
100
83
-
Learn more: [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md)
101
+
Once logging is enabled, and your WAF starts receiving request traffic, you can begin tuning your WAF by looking through your logs.
102
+
103
+
Learn more: [Tune Azure Web Application Firewall for Azure Front Door](../web-application-firewall/afds/waf-front-door-tuning.md)
84
104
85
105
The following query shows the requests blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode.
86
-
87
-
88
106
89
-
107
+
```json
108
+
AzureDiagnostics
109
+
| where TimeGenerated >= ago(24h)
110
+
| where Category == "FrontdoorWebApplicationFirewallLog"
|DefaultRuleSet-1.0-SQLI-942430|Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)|Block|detection|Matched Data: CfDJ8KQ8bY6D|
90
118
91
119
Review the WAF logs to determine if policy rules cause false positives. Then, exclude the WAF rules based on the WAF logs.
92
120
93
-
Learn more: [Define exclusion rules based on Web Application Firewall logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs)
121
+
Learn more
122
+
-[Configure WAF exclusion lists for Azure Front Door](../web-application-firewall/afds/waf-front-door-exclusion-configure.md)
123
+
-[Web application firewall exclusion lists in Azure Front Door](../web-application-firewall/afds/waf-front-door-exclusion.md)
124
+
125
+
Once logging is set up and your WAF is receiving traffic, you can assess the effectiveness of your bot manager rules in handling bot traffic. The following query shows the actions taken by your bot manager ruleset, categorized by bot type. While in **Detection mode**, the WAF logs bot traffic actions only. However, once switched to prevention mode, the WAF begins actively blocking unwanted bot traffic.
126
+
127
+
```json
128
+
AzureDiagnostics
129
+
| where Category == "FrontDoorWebApplicationFirewallLog"
130
+
| where action_s in ("Log", "Allow", "Block", "JSChallenge", "Redirect") and ruleName_s contains "BotManager"
| summarize Hits = count() by RuleGroupAction, bin(TimeGenerated, 30m)
134
+
| project TimeGenerated, RuleGroupAction, Hits
135
+
| render columnchart kind=stacked
136
+
```
94
137
95
138
#### Switching modes
96
139
97
-
To see WAF operating, select **Switch to prevention mode**, which changes the mode from Detection to Prevention. Requests that match the rules in the DRS are blocked and logged in the WAF logs.
98
-
99
-
140
+
To see WAF take action on request traffic, select **Switch to prevention mode** from the Overview page, which changes the mode from Detection to Prevention. Requests that match the rules in the DRS are blocked and logged in the WAF logs. The WAF takes the prescribed action when a request matches one, or more, rules in the DRS and logs the results. By default, the DRS is set to anomaly scoring mode; this means that the WAF doesn't take any action on a request unless the anomaly score threshold is met.
100
141
101
-
To revert to Detection mode, select **Switch to detection mode**.
142
+
Learn more: Anomaly scoring [Azure Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md#anomaly-scoring-mode)
102
143
103
-
144
+
To revert to **Detection mode**, select **Switch to detection mode** from the Overview page.
104
145
105
146
## Next steps
106
147
107
-
*[Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md)
108
-
*[Web Application Firewall (WAF) with Front Door exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md)
148
+
-[Best practices for Azure Web Application Firewall in Azure Front Door](../web-application-firewall/afds/waf-front-door-best-practices.md)
149
+
-[Manage Web Application Firewall policies](../firewall-manager/manage-web-application-firewall-policies.md)
150
+
-[Tune Azure Web Application Firewall for Azure Front Door](../web-application-firewall/afds/waf-front-door-tuning.md)
*[Exploring the Super Secret Kudu Debug Console](https://azure.microsoft.com/documentation/videos/super-secret-kudu-debug-console-for-azure-web-sites/)
275
+
*[Exploring the Super Secret Kudu Debug Console](https://www.youtube.com/watch?v=-VjqyvA2XjM)
Copy file name to clipboardExpand all lines: articles/app-service/environment/how-to-upgrade-preference.md
+6-2Lines changed: 6 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Configure the upgrade preference for the Azure App Service Environm
4
4
author: madsd
5
5
ms.topic: tutorial
6
6
ms.custom: devx-track-azurecli
7
-
ms.date: 06/25/2024
7
+
ms.date: 11/05/2024
8
8
zone_pivot_groups: app-service-cli-portal
9
9
---
10
10
@@ -34,10 +34,14 @@ In smaller regions, Early and Late upgrade preferences might be very close to ea
34
34
35
35
Manual upgrade preference gives you the option to receive a notification when an upgrade is available. The availability is also visible in the Azure portal. After the upgrade is available, you'll have 15 days to start the upgrade process. If you don't start the upgrade within the 15 days, the upgrade is processed with the remaining automatic upgrades in the region.
36
36
37
+
> [!IMPORTANT]
38
+
> In rare cases, you might see an upgrade is available in the **Configuration** page for your App Service Environment, but you don't receive a **Service Health** notification (if you [configure notifications](#configure-notifications)). If you don't receive a Service Health notification, this available upgrade isn't required and the 15-day time limit doesn't apply. This is a known bug that we are working to fix.
39
+
>
40
+
37
41
Upgrades normally don't affect the availability of your apps. The upgrade adds extra instances to ensure that the same capacity is available during upgrade. Patched and restarted instances are added back in rotation, and when you have workloads sensitive to restarts you should plan to start the maintenance during non-business hours. The full upgrade process normally finishes within 18 hours, but could take longer. Once the upgrade is started the upgrade runs until it's complete and isn't paused during standard business hours.
38
42
39
43
> [!NOTE]
40
-
> In rare cases the upgrade availability might be impacted by a security hotfix superseding the planned upgrade, or a regression found in the planned upgrade before it has been applied to your instance. In these rare cases, the available upgrade will be removed and will transition to automatic upgrade.
44
+
> In rare cases, the upgrade availability might be impacted by a security hotfix superseding the planned upgrade, or a regression found in the planned upgrade before it has been applied to your instance. In these rare cases, the available upgrade will be removed and will transition to automatic upgrade.
Copy file name to clipboardExpand all lines: articles/app-service/overview-authentication-authorization.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -172,9 +172,7 @@ When a request fulfills all these conditions, App Service authentication automat
172
172
173
173
When using Azure App Service with authentication behind Azure Front Door or other reverse proxies, a few additional things have to be taken into consideration.
174
174
175
-
- Disable caching for the authentication workflow.
176
-
177
-
See [Disable cache for auth workflow](../static-web-apps/front-door-manual.md#disable-cache-for-auth-workflow) to learn more on how to configure rules in Azure Front Door to disable caching for authentication and authorization-related pages.
175
+
- Disable [Front Door caching](../frontdoor/front-door-caching.md) for the authentication workflow.
0 commit comments