How can Azure Front Door change the action for a managed bot rule?

Definition: Azure Front Door changes a managed bot rule's action by placing a per-rule managed rule override inside a managed rule group override on a WAF policy. The policy must contain the bot protection rule set, which Microsoft's bot protection guide documents for Front Door Premium.

Key facts

• Microsoft's bot protection guide applies to Front Door Premium and says that its WAF provides bot rules to identify good bots and protect from bad bots.
• The bot rule set is added to a WAF policy as Microsoft_BotManagerRuleSet with a selected version, such as 1.0, through the portal, PowerShell, Azure CLI or Bicep.
• A managed rule override identifies a rule with ruleId and carries an action that applies when the rule matches, according to Microsoft's Front Door REST model.
• A rule group override names the managed rule group and receives the per-rule override objects.
• Microsoft's PowerShell reference shows -Action Log on a managed rule override.

How is the bot rule set deployed?

The bot protection guide states that a basic Front Door WAF policy is a prerequisite. In the Azure portal, open the WAF policy, select Managed rules, select Assign, choose the bot protection rule set version under Additional rule set, and select Save. The guide's Azure CLI example adds version 1.0 with this command:

az network front-door waf-policy managed-rules add \
  --resource-group FrontDoorWafPolicy \
  --policy-name WafPolicy \
  --type Microsoft_BotManagerRuleSet \
  --version 1.0

The same guide shows the PowerShell object type Microsoft_BotManagerRuleSet and version 1.0, then adds that object to the policy's ManagedRules collection before calling Update-AzFrontDoorWafPolicy.

How is one rule's action overridden?

Microsoft's PowerShell cmdlet creates an in-memory ManagedRuleOverride. Its syntax requires -RuleId and accepts -Action; the reference describes -Action as the override action applied when the rule matches. The -RuleId value identifies the managed bot rule whose action changes.

$botRuleOverride = New-AzFrontDoorWafManagedRuleOverrideObject `
  -RuleId "<managed bot rule ID>" `
  -Action Log

The override then belongs to a managed rule group override. Microsoft's rule group cmdlet requires -RuleGroupName and accepts -ManagedRuleOverride:

$botGroupOverride = New-AzFrontDoorWafRuleGroupOverrideObject `
  -RuleGroupName "<managed bot rule group>" `
  -ManagedRuleOverride $botRuleOverride

The group reference warns that if no managed rule overrides are specified, all rules in that group are disabled. Supplying the individual override object keeps the configuration scoped to the rule represented by its ruleId.

How is the override applied to the WAF policy?

The managed rule object accepts the rule set Type, Version and RuleGroupOverride parameters. The bot rule set values and the group override are combined in that object, which is then added to the policy before the policy update:

$botProtectionRuleSet = New-AzFrontDoorWafManagedRuleObject `
  -Type 'Microsoft_BotManagerRuleSet' `
  -Version '1.0' `
  -RuleGroupOverride $botGroupOverride

$frontDoorWafPolicy.ManagedRules.Add($botProtectionRuleSet)
$frontDoorWafPolicy | Update-AzFrontDoorWafPolicy

The managed rule object reference describes -RuleGroupOverride as the collection of group overrides applied to the rule set. The bot protection guide separately documents retrieving the policy, adding the managed rule object, and updating the policy.

What should be verified after deployment?

Microsoft's WAF tuning documentation says that WAF logs collect evaluated requests that the WAF matches or blocks. It identifies ruleName, action, and policyMode as fields used to inspect a match, and shows trackingReference for locating a specific event. The action recorded for the target rule can be checked after the policy update.

The same documentation says that policy changes can apply at profile, domain or route scope. When several scopes apply to a request, route-level policy takes precedence over domain-level policy, and domain-level policy takes precedence over profile-level policy. It also warns that assigning a new managed rule set resets previous managed-rule customizations, including rule state, rule actions and rule-level exclusions, to the new rule set's defaults.

Related terms

• Can an Azure Front Door custom allow rule bypass managed rules?
• How do AWS WAF Bot Control rules treat verified bots?
• How do I apply a Cloudflare WAF rule to one URL path?

FAQ

Is the bot protection rule set available on Front Door Standard?

Microsoft's bot protection guide applies to Front Door Premium. Its WAF tuning documentation also says that the Microsoft-managed rule set is unavailable for the Azure Front Door Standard SKU.

Does a rule group override disable every rule in the group?

The group override reference says that omitting the managed rule override list disables all rules in the group. The per-rule override object is passed when the intended change concerns one rule.

Can I set one managed rule to Log?

Yes. The managed rule override cmdlet accepts -Action, and Microsoft's example uses New-AzFrontDoorWafManagedRuleOverrideObject -RuleId "942250" -Action Log. Replace the example identifier with the target managed rule ID, place the object in its rule group override, and apply the updated policy.

Sources

1. Microsoft Learn, "Configure bot protection for Web Application Firewall with Azure Front Door", 29 April 2026
2. Microsoft Learn, "New-AzFrontDoorWafManagedRuleOverrideObject", 6 October 2026
3. Microsoft Learn, "New-AzFrontDoorWafRuleGroupOverrideObject", 6 October 2026
4. Microsoft Learn, "New-AzFrontDoorWafManagedRuleObject", 6 October 2026
5. Microsoft Learn, "Tune Azure Web Application Firewall for Azure Front Door", 1 September 2026
6. Microsoft Learn, "Policies - Update", 31 July 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer