Azure Compliance ControlsAzure Front Door
Azure Front Door services should have Web Application Firewall (WAF) enabled
Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. WAF provides centralized protection from common exploits and vulnerabilities such as SQL injections and Cross-Site Scripting.
What this control checks
Azure Front Door services must have Web Application Firewall (WAF) enabled
Framework mappings
The clauses this control is mapped to in each framework.
- SC-5 Denial-of-service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- SC-5 Denial Of Service Protection
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 5 Policy for Information System Audit (IS Audit)
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- SC-5 Denial Of Service Protection
- SC-7 Boundary Protection
- SC-7(3) Access Points
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
frontdoor_waf_enabled - Checkov Check:
CKV_AZURE_121 - Powerpipe Control:
azure_compliance.control.frontdoor_waf_enabled - Azure Policy Definition:
055aa869-bc98-4af8-bafc-23f1ab6ffe2c - KICS Query:
835a4f2f-df43-437d-9943-545ccfc55961
Last reviewed: 2026-10-13