Azure Front Door's adaptive HTTP DDoS rules are generally available, and they start in log-only mode

Microsoft made the HTTP DDoS ruleset for Azure Web Application Firewall on Front Door Premium generally available on 29 October (Azure update 578681). Instead of fixed rate limits, the ruleset learns what normal traffic looks like for each Front Door profile and acts when a surge looks like an attack. It applies to the Premium tier only.

How it decides

According to the Learn page:

• It needs history. Profiles that received traffic on at least half of the past seven days get baselines and start detecting spikes within 24 to 36 hours. Quieter profiles get no detection or mitigation until there’s enough traffic.
• Two stages. It learns a profile-wide threshold plus narrower per-client ones. The narrower thresholds only apply once total traffic on the profile breaks the profile threshold, so a few busy clients alone don’t trigger it.
• Per profile. One WAF policy attached to several Front Door profiles gets separate thresholds for each.
• Penalty box. Once the profile threshold is breached, a client IP over its own threshold gets the rule’s action until the penalty period ends.
• Readiness metric. HTTPDDoSRuleset Is Active reads 1 once learning is done.

The four rules

The ruleset shows up as Microsoft_HTTPDDoSRuleSet_1.0:

Rule	Baselines	Status
500100	Requests from each client IP	GA
500110	IPs Microsoft Threat Intelligence classes as bots (stricter default; high-risk bots blocked once the profile threshold is breached)	GA
500310	Each high-volume source country or region	Preview
500320	All other countries and regions combined	Preview

The geo rules target botnets that spread traffic so thin each IP stays under its own threshold. They act on a whole country or region, legitimate users included, so Microsoft suggests a JavaScript challenge over a block and lower sensitivity ahead of expected regional spikes.

Two defaults to know

Every rule starts with the Log action at medium sensitivity, so assigning the ruleset blocks nothing until you change it. Microsoft says to review the logs first.

The ruleset is also evaluated first, before custom rules, and a custom rule with an Allow action does not bypass it. To exempt health probes, synthetic monitoring, load tests or partner traffic, use WAF exceptions scoped to a rule or the whole ruleset, matched on remote IP, request URI or a header.

Log first, block later is the same review-before-block caution we gave for Cloudflare Threat Signals feeding its WAF. On the client side, a well-behaved caller that does get limited should read the response properly, as we covered in reading a 429.

Why this matters

Front Door Premium users can assign the ruleset today at low risk, because it only logs until you change an action. Before switching 500100 or 500110 to block, set up exceptions for your own probes and load tests, since an Allow rule won’t save them. Leave the preview geo rules on Log or a challenge until you have watched them through a normal traffic peak.