Microsoft Azure Azure CDN WebApplicationFirewallManagement

Name: Azure CDN WebApplicationFirewallManagement API
Brand: Azure CDN WebApplicationFirewallManagement
Availability: InStock

Browse all Azure APIs

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth26 Endpoints

Install Jentic One Beta

Connect the Azure CDN WebApplicationFirewallManagement to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure CDN WebApplicationFirewallManagement, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure CDN WebApplicationFirewallManagement API.

List the managed rule sets that can be attached to a CDN WAF policy

Enumerate CdnWebApplicationFirewallPolicies in a resource group

Retrieve a single WAF policy with its custom rules, managed rules, and rate-limit configuration

GET STARTED

Start building with Azure CDN WebApplicationFirewallManagement API

Explore with Jentic

View OpenAPI Document

For Agents

Manage Azure CDN Web Application Firewall policies and inspect available managed rule sets. Supports six endpoints for policy CRUD plus rule-set listing under Microsoft.Cdn.

Use for: I need to create a CDN WAF policy that blocks SQL injection attempts, List all CDN WAF policies in resource group cdn-prod, Retrieve the policy attached to my CDN endpoint to inspect its rules, Set up a rate-limit rule on a CDN WAF policy for /login traffic

Not supported: Does not configure Azure Front Door WAF, Application Gateway WAF, or DDoS Protection plans - use for Azure CDN WAF policies under Microsoft.Cdn only.

Use Cases

Patterns agents use Azure CDN WebApplicationFirewallManagement API for, with concrete tasks.

★ Block Common Web Attacks at the CDN Edge

Attach a CDN WAF policy that includes a managed rule set covering OWASP Top 10 categories such as SQL injection and XSS, evaluated at the Azure CDN edge before requests reach origin servers. The Web Application Firewall Management API lets you create the policy, reference the managed rule set ID, and link the policy to one or more CDN endpoints. Most teams roll out a baseline policy across an entire CDN profile in under an hour.

Create a CdnWebApplicationFirewallPolicy named edge-baseline in rg-cdn that references the latest DefaultRuleSet managed rule set with action=Block.

Rate-Limit Sensitive Endpoints

Throttle abusive traffic to login or checkout paths by adding rate-limit rules to a CDN WAF policy. The policy properties include a rateLimitRules array with matchConditions on RequestUri, plus thresholds in requests per minute. Once the policy is attached to a CDN endpoint, any client exceeding the threshold receives a 429 from the edge without ever hitting origin compute.

Update an existing CDN WAF policy to add a rate-limit rule on RequestUri Contains '/login' with rateLimitThreshold=100 and rateLimitDurationInMinutes=1.

Geo-Block Traffic by Country

Deny CDN traffic from specific countries by adding a custom rule with a RemoteAddr or GeoMatch operator to a WAF policy. The API supports custom rules with priorities and explicit Allow or Block actions, evaluated before managed rule sets. Rolling out the change is a single PATCH or PUT against the policy resource, with effect propagating across the CDN footprint within minutes.

Update CdnWebApplicationFirewallPolicy edge-baseline to add a custom rule with name=GeoBlock, priority=10, action=Block, and matchCondition GeoMatch on the configured country list.

Agent-Driven Policy Standardisation

A Jentic agent enumerates every CDN WAF policy across the tenant and patches each one to use the same managed rule set version, custom rules, and rate-limit configuration. The agent uses Policies_List to discover policies and Policies_CreateOrUpdate to converge them on a baseline, replacing manual portal review with deterministic enforcement.

List all CdnWebApplicationFirewallPolicies in subscription 1111-2222 and patch each policy whose managed rule set version is older than 1.0 to the latest available DefaultRuleSet version.

Key Endpoints

6 endpoints — the azure cdn web application firewall management api configures waf policies and managed rule sets attached to azure cdn endpoints.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets

List available managed rule sets

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies

List CDN WAF policies in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Get a single CDN WAF policy

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Create or update a CDN WAF policy

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Patch tags or basic state of a policy

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Delete a CDN WAF policy

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets

List available managed rule sets

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies

List CDN WAF policies in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Get a single CDN WAF policy

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Create or update a CDN WAF policy

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an Azure CDN WAF policy with managed rules' or 'add a rate-limit rule to a WAF policy', and Jentic returns the matching Policies operation with its full schema, including the managedRules and rateLimitRules blocks, so the agent does not read ARM docs.

Time to first call

FAQs

Specific to using Azure CDN WebApplicationFirewallManagement API through Jentic.

What authentication does the Azure CDN WAF Management API use?

Azure Active Directory OAuth 2.0 via the azure_auth scheme (user_impersonation scope) on https://management.azure.com/. Through Jentic, the AAD app credentials live in your Jentic One instance and the agent receives a runtime bearer token, never the secret.

Can I add a rate-limit rule with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} with a rateLimitRules array containing matchConditions, rateLimitThreshold (requests), and rateLimitDurationInMinutes.

What are the rate limits for the Azure CDN WAF Management API?

It shares Azure Resource Manager subscription throttling, typically 12,000 reads and 1,200 writes per hour per subscription. The API itself manages WAF rate-limit rules; do not confuse those data-plane limits with the control-plane ARM throttling that affects how often you can update policies.

How do I attach a managed rule set through Jentic?

Search Jentic for "create azure cdn waf policy", load the schema for Policies_CreateOrUpdate, populate the managedRules.managedRuleSets array with the desired ruleSetType and ruleSetVersion (discovered via ManagedRuleSets_List), then execute. Get an API key through Jentic One, the self-hosted execution layer.

Does this API protect Azure Front Door endpoints?

No. This API targets Azure CDN endpoints under Microsoft.Cdn. Azure Front Door uses its own WAF resource provider, Microsoft.Network/frontdoorWebApplicationFirewallPolicies, which is exposed by a different API.

Can a single policy be attached to multiple CDN endpoints?

Yes. A CdnWebApplicationFirewallPolicy can be referenced by multiple CDN endpoint resources, and changes to the policy propagate to every endpoint that links it. The policy resource tracks the linked endpoints via its endpointLinks property.

Can I limit what my agent is allowed to do with the Azure CDN WAF Management API?

Yes. Because you run Jentic One yourself, your own rules decide which of this API's operations the agent may call, so you can grant read-only access like listing policies and managed rule sets while excluding destructive calls such as deleting a policy or overwriting it with a create-or-update. Since this API places the subscription, resource group, and policy name directly in the URL path, you can also pin the agent to one specific WAF policy or resource group rather than the whole subscription. The Azure AD credential stays in your Jentic One instance and is injected only at execution time, never exposed to the agent.

Microsoft Azure Azure CDN WebApplicationFirewallManagement

Connect the Azure CDN WebApplicationFirewallManagement to your agent

Capabilities

Start building with Azure CDN WebApplicationFirewallManagement API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs