Can an Azure Front Door custom allow rule bypass managed rules?

Definition: Yes. When an Azure Front Door Web Application Firewall custom rule matches and uses the Allow action, the WAF allows the request, records a WAF log entry, and exits before managed rules are processed. The custom rule must match its conditions; its priority only controls when it is evaluated among custom rules.

Key facts

• A custom WAF rule has a priority number, rule type, match conditions, and an action, according to Microsoft's custom rules reference.
• A lower numeric priority is evaluated before a higher numeric priority, and priority numbers must be unique among custom rules.
• Microsoft says custom rules are processed before managed rules in its Front Door WAF tuning guidance.
• Allow lets the request proceed, logs an entry, and exits. Log records an entry and continues to the next rule in priority order.

How does custom rule priority affect evaluation?

Priority is the ordering value for custom WAF rules. Microsoft defines it as a unique integer and says rules with lower-priority values are evaluated before rules with higher values. A rule with priority 1 therefore gets evaluated before a rule with priority 2, provided both are enabled and in the same policy.

The action determines whether evaluation continues. The custom-rule reference says that evaluation stops on any action except Log. Log records the match and continues with the next rule in priority order. Allow, Block, and Redirect each end the current processing path after their documented result. A priority value only orders rules; matching comes from conditions and the action controls the result.

Why can Allow skip managed rules?

Azure's WAF tuning documentation states that custom rules are processed before managed rules. It also says that when a request matches a custom rule, the WAF engine stops processing that request, so processing ends before managed rules and lower-priority custom rules. Combined with the custom-rule reference's description of Allow as an action that lets the request process and exits, this means a matching custom Allow rule can let the request pass without managed-rule evaluation.

The result follows from a matching rule and its action, rather than from the word Allow in the rule name. If the conditions fail, the rule produces no allow result. If the action is Log, custom-rule evaluation continues to the next priority, so Log differs from a bypass action.

What does Microsoft's example look like?

Microsoft's custom-rule reference gives an AllowFromTrustedSites example with priority 1. It matches a Referer header equal to www.mytrustedsites.com/referpage.html and requires the query string not to contain password.

{
  "name": "AllowFromTrustedSites",
  "priority": 1,
  "ruleType": "MatchRule",
  "matchConditions": [
    {
      "matchVariable": "RequestHeader",
      "selector": "Referer",
      "operator": "Equal",
      "negateCondition": false,
      "matchValue": [
        "www.mytrustedsites.com/referpage.html"
      ]
    },
    {
      "matchVariable": "QueryString",
      "operator": "Contains",
      "matchValue": [
        "password"
      ],
      "negateCondition": true
    }
  ],
  "action": "Allow"
}

The example shows why the match conditions matter. A request needs both conditions in that rule to match before its terminating Allow action is reached. Microsoft also documents that custom rules can be disabled while retaining their configuration, so an intended exception must be enabled in the policy.

Related terms

• How can Azure Front Door change the action for a managed bot rule?
• How can Azure Front Door rate limits be scoped to website traffic?
• Which response headers cannot be modified by Azure Front Door rules?

FAQ

Does priority 1 by itself bypass managed rules?

No. Priority 1 places a rule before rules with higher numeric values. The rule's match conditions still have to match, and its action has to terminate processing.

Does a Log custom rule bypass managed rules?

No. The custom-rule reference says Log continues evaluation with the next rule in priority order. The terminating behavior belongs to actions such as Allow, Block, and Redirect.

What happens when a custom Allow rule matches?

The WAF allows the request to process, writes an entry in WAF logs, and exits. Microsoft's tuning guidance says managed rules are skipped for a request that matches a custom rule.

Sources

1. Microsoft Learn, "Custom rules for Azure Web Application Firewall on Azure Front Door", 25 February 2026
2. Microsoft Learn, "Tune Azure Web Application Firewall for Azure Front Door", 1 September 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer