My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?

jesseve 20

I have a bicep template defining App Gateway Web Application Firewall policy with exceptions. I am using api-version 2024-03-01 https://learn.microsoft.com/en-us/azure/templates/microsoft.network/2024-03-01/applicationgatewaywebapplicationfirewallpolicies

When I deploy the file I get this error message: "Region is not enabled for Exception feature". I tried multiple regions and all fail with the same message.

Is it possible to enable the feature and if yes, how would I do it?

Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2024-12-17T01:08:34.98+00:00
Hi jesseve

Greetings!

Welcome to Microsoft Q&A, thank you for posting your question here!

Could you please specify which configuration in the Bicep template is causing this error? Once we have this information, we can attempt to reproduce the issue.

How to Create Web Application Firewall policies for Application Gateway

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

Web Application Firewall exclusion lists

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal

Regards,

Ganesh

jesseve 20

I have set the 'managedRules.exceptions' property in the bicep template. Without it the deployment passes.

You could test with this bicep:

param location string = 'northeurope'
resource appGatewayWafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2024-03-01' = {
  name: 'wafpolicy'
  location: location
  properties: {
    managedRules: {
      exceptions: [
        {
          matchVariable: 'RequestURI'
          valueMatchOperator: 'StartsWith'
          values: [
            'https://test.com'
          ]
          exceptionManagedRuleSets: [
            {
              ruleSetType: 'OWASP'
              ruleSetVersion: '3.2'
              ruleGroups:[
                {
                  ruleGroupName: 'REQUEST-942-APPLICATION-ATTACK-SQLI'
                  rules: [
                    {
                      ruleId: '942200'
                    }
                  ]
                }
              ]
            }
          ]
        }
      ]
      managedRuleSets: [
        {
          ruleSetType: 'OWASP'
          ruleSetVersion: '3.2'
        }
      ]
    }
  }
}

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2024-12-19T23:03:13.2633333+00:00
Hello jesseve

We appreciate your patience!

"Region is not enabled for Exception feature" Let me check whether this feature is available?

Could you please provide the complete Bicep code? This would greatly assist me in reproducing the issue and for better understanding.

Can you please send me the screenshot of the error you are getting.

Could you please try using Azure CLI and inform me if this feature works with it?

If you have any further questions or need additional assistance in refining this approach, please let me know!

If above is unclear and/or you are unsure about something add a comment below.

Regards,

Ganesh
jesseve 20 Reputation points

2024-12-20T10:19:44.67+00:00

Hello, the bicep code above is the complete code I used.

Here is a screenshot of the error message.

I am not sure which Azure CLI command to use for this feature, so can't really test that option.
Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2024-12-26T10:30:07.4233333+00:00

Hello jesseve

Any updates on this thread?

Regards,

Ganesh
Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2024-12-27T08:46:14.1366667+00:00

Hello jesseve

Any updates on this thread?

Regards,

Ganesh
jesseve 20 Reputation points

2025-01-03T08:11:21.8866667+00:00

Hello,

My goal was to add a per-site WAF-policies like mentioned in this document: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies.

I noticed the exceptions property when I was modifying bicep code so I was curious and wanted to test it out because based on the documentation, it seemed to do the same thing without adding multiple WAF-policy resources.

I figured the feature might be in preview so I implemented the per-site policies instead.

Thank you for your time and help with the issue Ganesh.
Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2025-01-03T08:23:36.4333333+00:00
Hello jesseve

Good to hear from you!

I have transformed my comment into an answer.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh

Accepted answer

Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2024-12-24T20:01:03.8866667+00:00
Hello jesseve

We appreciate your patience!

I am not able to find any documents explaining the "Exception feature in Application gateway" It appears to be a Preview feature.

Are you sure you are using this feature or are you trying to use the application gateway exclusion feature.

NOTE: Exclusion and exceptions are totally different.

What's your end goal and it looks like a preview feature, and it is not available to public, and I am not getting any documents for this.

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh
Please sign in to rate this answer.
Ganesh Patapati 2,825 Reputation points Microsoft Vendor

2025-01-03T08:23:59.31+00:00

Hello jesseve

Good to hear from you!

I have transformed my comment into an answer.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?

0 additional answers

Your answer