My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?

jesseve 0

I have a bicep template defining App Gateway Web Application Firewall policy with exceptions. I am using api-version 2024-03-01 https://learn.microsoft.com/en-us/azure/templates/microsoft.network/2024-03-01/applicationgatewaywebapplicationfirewallpolicies

When I deploy the file I get this error message: "Region is not enabled for Exception feature". I tried multiple regions and all fail with the same message.

Is it possible to enable the feature and if yes, how would I do it?

Ganesh Patapati 2,590 Reputation points Microsoft Vendor

2024-12-17T01:08:34.98+00:00
Hi jesseve

Greetings!

Welcome to Microsoft Q&A, thank you for posting your question here!

Could you please specify which configuration in the Bicep template is causing this error? Once we have this information, we can attempt to reproduce the issue.

How to Create Web Application Firewall policies for Application Gateway

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

Web Application Firewall exclusion lists

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal

Regards,

Ganesh

jesseve 0

I have set the 'managedRules.exceptions' property in the bicep template. Without it the deployment passes.

You could test with this bicep:

param location string = 'northeurope'
resource appGatewayWafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2024-03-01' = {
  name: 'wafpolicy'
  location: location
  properties: {
    managedRules: {
      exceptions: [
        {
          matchVariable: 'RequestURI'
          valueMatchOperator: 'StartsWith'
          values: [
            'https://test.com'
          ]
          exceptionManagedRuleSets: [
            {
              ruleSetType: 'OWASP'
              ruleSetVersion: '3.2'
              ruleGroups:[
                {
                  ruleGroupName: 'REQUEST-942-APPLICATION-ATTACK-SQLI'
                  rules: [
                    {
                      ruleId: '942200'
                    }
                  ]
                }
              ]
            }
          ]
        }
      ]
      managedRuleSets: [
        {
          ruleSetType: 'OWASP'
          ruleSetVersion: '3.2'
        }
      ]
    }
  }
}

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Ganesh Patapati 2,590 Reputation points Microsoft Vendor

2024-12-19T23:03:13.2633333+00:00
Hello jesseve

We appreciate your patience!

"Region is not enabled for Exception feature" Let me check whether this feature is available?

Could you please provide the complete Bicep code? This would greatly assist me in reproducing the issue and for better understanding.

Can you please send me the screenshot of the error you are getting.

Could you please try using Azure CLI and inform me if this feature works with it?

If you have any further questions or need additional assistance in refining this approach, please let me know!

If above is unclear and/or you are unsure about something add a comment below.

Regards,

Ganesh
jesseve 0 Reputation points

2024-12-20T10:19:44.67+00:00

Hello, the bicep code above is the complete code I used.

Here is a screenshot of the error message.

I am not sure which Azure CLI command to use for this feature, so can't really test that option.
Ganesh Patapati 2,590 Reputation points Microsoft Vendor

2024-12-24T20:01:03.8866667+00:00
Hello jesseve

We appreciate your patience!

I am not able to find any documents explaining the "Exception feature in Application gateway" It appears to be a Preview feature.

Are you sure you are using this feature or are you trying to use the application gateway exclusion feature.

NOTE: Exclusion and exceptions are totally different.

What's your end goal and it looks like a preview feature, and it is not available to public, and I am not getting any documents for this.

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh

Share via

My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?

Your answer