Microsoft Azure Azure CDN WebApplicationFirewallManagement
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth26 EndpointsREST
For Agents
Manage Azure CDN Web Application Firewall policies and inspect available managed rule sets. Supports six endpoints for policy CRUD plus rule-set listing under Microsoft.Cdn.
Use for: I need to create a CDN WAF policy that blocks SQL injection attempts, List all CDN WAF policies in resource group cdn-prod, Retrieve the policy attached to my CDN endpoint to inspect its rules, Set up a rate-limit rule on a CDN WAF policy for /login traffic
Not supported: Does not configure Azure Front Door WAF, Application Gateway WAF, or DDoS Protection plans — use for Azure CDN WAF policies under Microsoft.Cdn only.
The Azure CDN Web Application Firewall Management API configures WAF policies and managed rule sets attached to Azure CDN endpoints. It exposes operations to list, create, update, and delete CdnWebApplicationFirewallPolicies under Microsoft.Cdn, plus a discovery endpoint for the managed rule sets that ship with the service. Each policy bundles custom rules, managed rule sets, and rate-limit rules that Azure CDN evaluates on incoming HTTP requests.
Install Jentic One Beta
Connect the Azure CDN WebApplicationFirewallManagement to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure CDN WebApplicationFirewallManagement, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure CDN WebApplicationFirewallManagement API.
List the managed rule sets that can be attached to a CDN WAF policy
Enumerate CdnWebApplicationFirewallPolicies in a resource group
Retrieve a single WAF policy with its custom rules, managed rules, and rate-limit configuration
Create or update a CDN WAF policy with custom rules and managed rule overrides
Patch a policy's tags or enabled state without rewriting the full configuration
Delete a CDN WAF policy that is no longer attached to any CDN endpoint
Use Cases
Patterns agents use Azure CDN WebApplicationFirewallManagement API for, with concrete tasks.
★ Block Common Web Attacks at the CDN Edge
Attach a CDN WAF policy that includes a managed rule set covering OWASP Top 10 categories such as SQL injection and XSS, evaluated at the Azure CDN edge before requests reach origin servers. The Web Application Firewall Management API lets you create the policy, reference the managed rule set ID, and link the policy to one or more CDN endpoints. Most teams roll out a baseline policy across an entire CDN profile in under an hour.
Create a CdnWebApplicationFirewallPolicy named edge-baseline in rg-cdn that references the latest DefaultRuleSet managed rule set with action=Block.
Rate-Limit Sensitive Endpoints
Throttle abusive traffic to login or checkout paths by adding rate-limit rules to a CDN WAF policy. The policy properties include a rateLimitRules array with matchConditions on RequestUri, plus thresholds in requests per minute. Once the policy is attached to a CDN endpoint, any client exceeding the threshold receives a 429 from the edge without ever hitting origin compute.
Update an existing CDN WAF policy to add a rate-limit rule on RequestUri Contains '/login' with rateLimitThreshold=100 and rateLimitDurationInMinutes=1.
Geo-Block Traffic by Country
Deny CDN traffic from specific countries by adding a custom rule with a RemoteAddr or GeoMatch operator to a WAF policy. The API supports custom rules with priorities and explicit Allow or Block actions, evaluated before managed rule sets. Rolling out the change is a single PATCH or PUT against the policy resource, with effect propagating across the CDN footprint within minutes.
Update CdnWebApplicationFirewallPolicy edge-baseline to add a custom rule with name=GeoBlock, priority=10, action=Block, and matchCondition GeoMatch on the configured country list.
Agent-Driven Policy Standardisation
A Jentic agent enumerates every CDN WAF policy across the tenant and patches each one to use the same managed rule set version, custom rules, and rate-limit configuration. The agent uses Policies_List to discover policies and Policies_CreateOrUpdate to converge them on a baseline, replacing manual portal review with deterministic enforcement.
List all CdnWebApplicationFirewallPolicies in subscription 1111-2222 and patch each policy whose managed rule set version is older than 1.0 to the latest available DefaultRuleSet version.
Key Endpoints
6 endpoints — the azure cdn web application firewall management api configures waf policies and managed rule sets attached to azure cdn endpoints.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets
List available managed rule sets
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies
List CDN WAF policies in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Get a single CDN WAF policy
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Create or update a CDN WAF policy
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Patch tags or basic state of a policy
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Delete a CDN WAF policy
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets
List available managed rule sets
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies
List CDN WAF policies in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Get a single CDN WAF policy
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Create or update a CDN WAF policy
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Patch tags or basic state of a policy
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Delete a CDN WAF policy
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD service principal credentials stay in the Jentic MAXsystem vault. Agents call the WAF management endpoints with a scoped bearer token issued at runtime, so no secret material flows through prompts, logs, or agent memory.
Intent-based discovery
Agents search Jentic by intent (e.g. "create azure cdn waf policy with managed rules") and Jentic returns the matching Policies operation with its full schema, including the managedRules and rateLimitRules blocks, so the agent does not need to read ARM docs.
Time to first call
Direct integration: about a day for AAD setup, ARM long-running operation polling, and rule-set discovery. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure CDN WebApplicationFirewallManagement API through Jentic.
What authentication does the Azure CDN WAF Management API use?
Azure Active Directory OAuth 2.0 via the azure_auth scheme (user_impersonation scope) on https://management.azure.com/. Through Jentic, the AAD app credentials live in the MAXsystem vault and the agent receives a runtime bearer token, never the secret.
Can I add a rate-limit rule with this API?
Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} with a rateLimitRules array containing matchConditions, rateLimitThreshold (requests), and rateLimitDurationInMinutes.
What are the rate limits for the Azure CDN WAF Management API?
It shares Azure Resource Manager subscription throttling, typically 12,000 reads and 1,200 writes per hour per subscription. The API itself manages WAF rate-limit rules; do not confuse those data-plane limits with the control-plane ARM throttling that affects how often you can update policies.
How do I attach a managed rule set through Jentic?
Search Jentic for "create azure cdn waf policy", load the schema for Policies_CreateOrUpdate, populate the managedRules.managedRuleSets array with the desired ruleSetType and ruleSetVersion (discovered via ManagedRuleSets_List), then execute. Get an API key at https://app.jentic.com/sign-up.
Does this API protect Azure Front Door endpoints?
No. This API targets Azure CDN endpoints under Microsoft.Cdn. Azure Front Door uses its own WAF resource provider, Microsoft.Network/frontdoorWebApplicationFirewallPolicies, which is exposed by a different API.
Can a single policy be attached to multiple CDN endpoints?
Yes. A CdnWebApplicationFirewallPolicy can be referenced by multiple CDN endpoint resources, and changes to the policy propagate to every endpoint that links it. The policy resource tracks the linked endpoints via its endpointLinks property.
GET STARTED