---
title: "Azure WAF"
slug: "azure-waf"
updated: 2025-11-11T13:57:36Z
published: 2025-11-11T13:57:36Z
canonical: "docs.databee.buzz/azure-waf"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure WAF

Azure Web Application Firewall (WAF) provides centralized protection of your web applications and APIs from common exploits and vulnerabilities. Web applications increasingly encounter malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. For more details refer to [Microsoft’s official documentation](https://learn.microsoft.com/en-us/azure/web-application-firewall/).

**Integration Method**: API

To ingest events via EventHub, refer to the [Azure WAF Event Hub guide](/user-manual/docs/azure-waf-eventhub).

**Tables**: HTTP Activity (4002), Web Resources Activity (6001)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Firewall | To monitor, analyze, and troubleshoot security incidents. |
| Access | Access Control mechanisms, which determine who or what can interact with web applications. |

This integration supports the following versions.

| Azure WAF API version | 2024-05-01 |
| --- | --- |

> [!NOTE]
> **Note:**
> 
> Azure WAF is a continuously updated cloud service. As for this document preparation, the latest release was in [May 2024](https://learn.microsoft.com/en-us/rest/api/application-gateway/web-application-firewall-policies/list?view=rest-application-gateway-2024-05-01&tabs=HTTP).

## Prerequisites

- The user should have access to the [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privileges.
- The user should have access to the DataBee console.

## Configuration Overview

1. [Create an application](/user-manual/docs/azure-waf#create-an-application) with required permissions to fetch the data.
2. Create [Azure WAF Data Feed](/user-manual/docs/azure-waf#databee-configuration) in the DataBee console with the required Client credentials.

| **DataBee Parameter** | **Azure Parameter** |
| --- | --- |
| Client Key | [Application (client ID)](/docs/azure-waf#clientid) |
| Client Secret | [Client secret Value](/user-manual/docs/azure-waf#create-the-client-secret) |
| Token URL(<tenant_id>) | [Directory (Tenant) ID](/docs/azure-waf#tenantid) |
| Workspace ID (workspaceId) | Workspace ID |

## Azure Configuration

### Create an application

1. Log on to [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privileges.

In the search bar, search for **App Registrations** and select it.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-d7g51qt4.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
2. On the “Register an application” window:

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-xpvg2r98.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
  1. Under ‘Name’**,** enter your Application Name then click on **Register** to create the application.
3. On the app **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** for later use.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-y4azochv.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
4. Login on to [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privilege. In the search bar check for **Log Analytics Workspaces** and select it.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-8nn2nd28.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
5. Search for the **Workspace** and select it. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-4ul5y4c9.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
6. On the **Overview** page, copy the **Workspace ID** for later use.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-25j2f6kn.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)

### Add Endpoint Access

Once the application is created, three permissions should be provided to fetch data. The appropriate permissions for the application are needed to access these endpoints. The following section details how to configure and add permissions to the required endpoints.

#### Add Permissions

From the Azure Active Directory portal:

1. Select the application registered in the previous step.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-voektcgd.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
2. Under **Manage,** Select **API Permissions** > **Add a Permission,** the “Request API permissions” window will appear. On the **APIs my organization uses** tab, search for **Log Analytics** and select **Log Analytics API** from the list.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-7dojmel6.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
3. On the **Log Analytics API** overview, Select **Delegated permissions** and Select the **Data.Read** checkbox and Select **Add permissions**.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-bvx4s33i.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
4. The following permissions need to be granted for the endpoint to function properly:

| **Event** | **Type** | **Permission Name** |
| --- | --- | --- |
| Firewall | Delegated | Data.Read |
| Access | Delegated | Data.Read |

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-kedh22pe.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
5. Now that your app is registered and has permissions to use the API, grant your app access to your **Log Analytics workspace**.

From your Log Analytics workspace overview page, select **Access control (IAM)** > **Add role assignment.**

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-85v1cw47.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
6. Under Role select the **Reader** and **select member** to be added.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-8bcx98ls.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
7. On the **Members** tab, choose **Select members,** Enter the name of your app in the Select box**,** select your app and choose **Select.**

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-380uuvrk.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
8. Select **Review + assign**.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-dmhgy276.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)

### Create the Client Secret

The final step in accessing the APIs is creating a Client Secret. To create it from the Azure Portal:

1. Select the application created above.
2. Under **Manage**, Click **Certificates & Secrets**, and then **Client Secrets**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-gtl2begj.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
3. Click **New client secret**. Then “Add a client secret” window appears. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-1snx7o4d.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
4. On “Add a client secret” window:
  1. Enter a ‘Description’ for this client secret and select the desired expiry period from the ‘Expires’ drop-list.
  2. Then click on **Add** to create the client secret. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-6c374apr.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)

> [!NOTE]
> Note:
> 
> The user needs to re-create the client secret when it expires.
5. Copy the ‘Value’ fields for later use.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-ncs50lj7.jpg?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)

This completes the setup for Azure Activity API integration.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-nnyhwyjb.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
2. Search for the Azure / Azure WAF and click it as shown below.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-1l9nug82.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
3. Click on the **API Ingest** option for collection method. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-wl22yc4w.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
4. Enter feed contact information and click **Next.** ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-s3w3xjn4.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
5. In the configuration page, confirm the following:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-mar2025-image-hc641gvg.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A21%3A10Z&se=2026-10-30T13%3A21%3A10Z&sr=c&sp=r&sig=G0pjU%2F16imVRIFfxzn1BJttDTlhFthOl%2FpFFmtJNx8s%3D)
  - Authorization Method: OAuth2
  - Client Key: Paste the [Application (Client) ID](/docs/azure-waf#clientid) generated previously.
  - Client Secret: Paste the **Client Secret** generated previously.
  - Token URL: Replace <tenant_id> placeholder with your [Directory (Tenant) ID](/docs/azure-waf#tenantid).
  - Workspace ID: Paste the Workspace ID noted earlier.
  - Event Types: Preselected for all the event types that integration pulls.
6. Click **Submit**.

## Troubleshooting Tips

- If you are facing an **invalid client** or **unauthorized** client error this might be possibly due to incorrect credentials. Ensure the client key, client secret and Tenant ID are pasted correctly. Since you cannot view the client secret after the 1st time, re-create it, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- If you are facing response code - **403** this might be possibly due to missing permissions. Ensure that all the required permissions are granted correctly as per the above-mentioned steps.