Azure Compliance ControlsAzure Web Application Firewall
Application Gateway Web Application Firewall policies should have request body inspection enabled
Ensure that Web Application Firewalls associated to Azure Application Gateways have request body inspection enabled. This allows the WAF to inspect properties within the HTTP body that may not be evaluated in the HTTP headers, cookies, or URI.
What this control checks
Application Gateway WAF policies must have request body inspection enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 7.14 Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
web_application_firewall_policy_request_body_inspection_enabled - Powerpipe Control:
azure_compliance.control.web_application_firewall_policy_request_body_inspection_enabled - Azure Policy Definition:
ca85ef9a-741d-461d-8b7a-18c2da82c666
Last reviewed: 2026-10-15