|
1 | 1 | --- |
2 | 2 | title: Tutorial to configure Azure Active Directory B2C with Azure Web Application Firewall |
3 | 3 | titleSuffix: Azure AD B2C |
4 | | -description: Tutorial to configure Azure Active Directory B2C with Azure Web application firewall to protect your applications from malicious attacks |
| 4 | +description: Learn to configure Azure AD B2C with Azure Web Application Firewall to protect applications from malicious attacks |
5 | 5 | services: active-directory-b2c |
6 | 6 | author: gargi-sinha |
7 | | -manager: CelesteDG |
| 7 | +manager: martinco |
8 | 8 | ms.reviewer: kengaderdus |
9 | | - |
10 | 9 | ms.service: active-directory |
11 | 10 | ms.workload: identity |
12 | 11 | ms.topic: how-to |
13 | | -ms.date: 08/17/2021 |
| 12 | +ms.date: 03/08/2023 |
14 | 13 | ms.author: gasinh |
15 | 14 | ms.subservice: B2C |
16 | 15 | --- |
17 | 16 |
|
18 | | -# Tutorial: Configure Azure Web Application Firewall with Azure Active Directory B2C |
| 17 | +# Tutorial: Configure Azure Active Directory B2C with Azure Web Application Firewall |
19 | 18 |
|
20 | | -In this sample tutorial, learn how to enable [Azure Web Application Firewall (WAF)](https://azure.microsoft.com/services/web-application-firewall/#overview) solution for Azure Active Directory (AD) B2C tenant with custom domain. Azure WAF provides centralized protection of your web applications from common exploits and vulnerabilities. |
| 19 | +Learn how to enable the Azure Web Application Firewall (WAF) service for an Azure Active Directory B2C (Azure AD B2C) tenant, with a custom domain. WAF protects web applications from common exploits and vulnerabilities. |
21 | 20 |
|
22 | | ->[!NOTE] |
23 | | ->This feature is in public preview. |
| 21 | +See, [What is Azure Web Application Firewall?](../web-application-firewall/overview.md) |
24 | 22 |
|
25 | 23 | ## Prerequisites |
26 | 24 |
|
27 | | -To get started, you'll need: |
28 | | - |
29 | | -- An Azure subscription – If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). |
30 | | - |
31 | | -- [An Azure AD B2C tenant](tutorial-create-tenant.md) – The authorization server, responsible for verifying the user’s credentials using the custom policies defined in the tenant. It's also known as the identity provider. |
| 25 | +To get started, you need: |
32 | 26 |
|
33 | | -- [Azure Front Door (AFD)](../frontdoor/index.yml) – Responsible for enabling custom domains for Azure AD B2C tenant. |
| 27 | +* An Azure subscription |
| 28 | +* If you don't have one, get an [Azure free account](https://azure.microsoft.com/free/) |
| 29 | +* **An Azure AD B2C tenant** – authorization server that verifies user credentials using custom policies defined in the tenant |
| 30 | + * Also known as the identity provider (IdP) |
| 31 | + * See, [Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md) |
| 32 | +* **Azure Front Door (AFD)** – enables custom domains for the Azure AD B2C tenant |
| 33 | + * See, [Azure Front Door and CDN documentation](../frontdoor/index.yml) |
| 34 | +* **WAF** – manages traffic sent to the authorization server |
| 35 | + * [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/#overview) |
34 | 36 |
|
35 | | -- [Azure WAF](https://azure.microsoft.com/services/web-application-firewall/#overview) – Manages all traffic that is sent to the authorization server. |
| 37 | +## Custom domains in Azure AD B2C |
36 | 38 |
|
37 | | -## Azure AD B2C setup |
| 39 | +To use custom domains in Azure AD B2C, use the custom domain features in AFD. See, [Enable custom domains for Azure AD B2C](./custom-domain.md?pivots=b2c-user-flow). |
38 | 40 |
|
39 | | -To use custom domains in Azure AD B2C, it's required to use custom domain feature provided by AFD. Learn how to [enable Azure AD B2C custom domains](./custom-domain.md?pivots=b2c-user-flow). |
| 41 | + > [!IMPORTANT] |
| 42 | + > After you configure the custom domain, see [Test your custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain). |
40 | 43 |
|
41 | | -After custom domain for Azure AD B2C is successfully configured using AFD, [test the custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain) before proceeding further. |
| 44 | +## Enable WAF |
42 | 45 |
|
43 | | -## Onboard with Azure WAF |
44 | | - |
45 | | -To enable Azure WAF, configure a WAF policy and associate that policy to the AFD for protection. |
| 46 | +To enable WAF, configure a WAF policy and associate it with the AFD for protection. |
46 | 47 |
|
47 | 48 | ### Create a WAF policy |
48 | 49 |
|
49 | | -Create a basic WAF policy with managed Default Rule Set (DRS) in the [Azure portal](https://portal.azure.com). |
50 | | - |
51 | | -1. Go to the [Azure portal](https://portal.azure.com). Select **Create a resource** and then search for Azure WAF. Select **Azure Web Application Firewall (WAF)** > **Create**. |
| 50 | +Create a WAF policy with Azure-managed default rule set (DRS). See, [Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md). |
52 | 51 |
|
53 | | -2. Go to the **Create a WAF policy** page, select the **Basics** tab. Enter the following information, accept the defaults for the remaining settings. |
| 52 | +1. Go to the [Azure portal](https://portal.azure.com). |
| 53 | +2. Select **Create a resource**. |
| 54 | +3. Search for Azure WAF. |
| 55 | +4. Select **Azure Web Application Firewall (WAF)**. |
| 56 | +5. Select **Create**. |
| 57 | +6. Go to the **Create a WAF policy** page. |
| 58 | +7. Select the **Basics** tab. |
| 59 | +8. For **Policy for**, select **Global WAF (Front Door)**. |
| 60 | +9. For **Front Door SKU**, select between **Basic**, **Standard**, or **Premium** SKU. |
| 61 | +10. For **Subscription**, select your Front Door subscription name. |
| 62 | +11. For **Resource group**, select your Front Door resource group name. |
| 63 | +12. For **Policy name**, enter a unique name for your WAF policy. |
| 64 | +13. For **Policy state**, select **Enabled**. |
| 65 | +14. For **Policy mode**, select **Detection**. |
| 66 | +15. Select **Review + create**. |
| 67 | +16. Go to the **Association** tab of the Create a WAF policy page. |
| 68 | +17. Select **+ Associate a Front Door profile**. |
| 69 | +18. For **Front Door**, select your Front Door name associated with Azure AD B2C custom domain. |
| 70 | +19. For **Domains**, select the Azure AD B2C custom domains to associate the WAF policy to. |
| 71 | +20. Select **Add**. |
| 72 | +21. Select **Review + create**. |
| 73 | +22. Select **Create**. |
54 | 74 |
|
55 | | -| Value | Description | |
56 | | -|:--------|:-------| |
57 | | -| Policy for | Global WAF (Front Door)| |
58 | | -| Front Door SKU | Select between Basic, Standard, or Premium SKU | |
59 | | -|Subscription | Select your Front Door subscription name | |
60 | | -| Resource group | Select your Front Door resource group name | |
61 | | -| Policy name | Enter a unique name for your WAF policy | |
62 | | -| Policy state | Set as Enabled | |
63 | | -| Policy mode | Set as Detection | |
| 75 | +### Detection and Prevention modes |
64 | 76 |
|
65 | | -3. Select **Review + create** |
| 77 | +When you create WAF policy, the policy is in Detection mode. We recommend you don't disable Detection mode. In this mode, WAF doesn't block requests. Instead, requests that match the WAF rules are logged in the WAF logs. |
66 | 78 |
|
67 | | -4. Go to the **Association** tab of the Create a WAF policy page, select + **Associate a Front Door profile**, enter the following settings |
| 79 | +Learn more: [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md) |
68 | 80 |
|
69 | | -| Value | Description | |
70 | | -|:----|:------| |
71 | | -| Front Door | Select your Front Door name associated with Azure AD B2C custom domain | |
72 | | -| Domains | Select the Azure AD B2C custom domains you want to associate the WAF policy to| |
| 81 | +The following query shows the requests blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode. |
| 82 | + |
| 83 | +  |
73 | 84 |
|
74 | | -5. Select **Add**. |
| 85 | +  |
75 | 86 |
|
76 | | -6. Select **Review + create**, then select **Create**. |
| 87 | +Review the WAF logs to determine if policy rules cause false positives. Then, exclude the WAF rules based on the WAF logs. |
77 | 88 |
|
78 | | -### Change policy mode from detection to prevention |
| 89 | +Learn more: [Define exclusion rules based on Web Application Firewall logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs) |
79 | 90 |
|
80 | | -When a WAF policy is created, by default the policy is in Detection mode. In Detection mode, WAF doesn't block any requests, instead, requests matching the WAF rules are logged in the WAF logs. For more information about WAF logging, see [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md). |
| 91 | +#### Switching modes |
81 | 92 |
|
82 | | -The sample query shows all the requests that were blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode. |
| 93 | +To see WAF operating, select **Switch to prevention mode**, which changes the mode from Detection to Prevention. Requests that match the rules in the DRS are blocked and logged in the WAF logs. |
83 | 94 |
|
84 | | - |
| 95 | +  |
85 | 96 |
|
86 | | - |
| 97 | +To revert to Detection mode, select **Switch to detection mode**. |
87 | 98 |
|
88 | | -It's recommended that you let the WAF capture requests in Detection mode. Review the WAF logs to determine if there are any rules in the policy that are causing false positive results. Then after [exclude the WAF rules based on the WAF logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs). |
89 | | - |
90 | | -To see WAF in action, use Switch to prevention mode to change from Detection to Prevention mode. All requests that match the rules defined in the Default Rule Set (DRS) are blocked and logged in the WAF logs. |
91 | | - |
92 | | - |
93 | | - |
94 | | -In case you want to switch back to the detection mode, you can do so by using Switch to detection mode option. |
95 | | - |
96 | | - |
| 99 | +  |
97 | 100 |
|
98 | 101 | ## Next steps |
99 | 102 |
|
100 | | -- [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md) |
101 | | - |
102 | | -- [WAF with Front Door service exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md) |
| 103 | +* [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md) |
| 104 | +* [Web Application Firewall (WAF) with Front Door exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md) |
0 commit comments