Azure Compliance ControlsAzure Application Gateway
Application gateways should use the specified Web Application Firewall (WAF) mode
Checks that the Web Application Firewall (WAF) on Azure Application Gateway uses the specified mode. The control requires WAF policies to be set to either `Detection` mode or `Prevention` mode, and evaluates the configured mode against that requirement.
What this control checks
Application Gateway WAF must use the specified mode ('Detection' or 'Prevention').
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Policy for Information System Audit (IS Audit)
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
application_gateway_waf_uses_specified_mode - Powerpipe Control:
azure_compliance.control.application_gateway_waf_uses_specified_mode
Last reviewed: 2026-10-10