How can Azure Front Door rate limits be scoped to website traffic?

Definition: An Azure Front Door rate limit is a custom Web Application Firewall rule that activates when its match conditions select a request and its request count reaches a threshold. Microsoft documents the counting group as the socket IP address, with a fixed one minute or five minute window for each matching group.

Key facts

• A custom WAF rule contains a priority number, rule type, match conditions, and an action. Microsoft distinguishes match rules from rate limit rules, with the latter combining matching conditions and incoming request rates in the custom rules reference.
• Lower numeric priority values are evaluated first. Evaluation stops after any action except Log, and priority values must be unique among custom rules, according to the same Microsoft reference.
• The threshold is the number of requests allowed from each socket IP address during either one minute or five minutes, as stated in Microsoft's rate limiting documentation.
• A rate limit needs at least one match condition, and multiple rate limits can apply to different paths within an application. The same rate limiting documentation gives this configuration model.
• The rate counter can be affected by Front Door server distribution. Microsoft says that with a low threshold, for example less than about 200 requests per minute, some requests above the threshold might pass when connections reach a server whose counters have not refreshed.

How does a rule select website traffic?

The rule's match conditions define the traffic scope. Microsoft's custom rules reference describes each condition as a match variable, an operator, and a match value. It lists request methods, query strings, request URIs, request headers, client IP addresses in CIDR notation, size, AS number, client fingerprint, service tag, and string matching. A rule can contain multiple match conditions.

For a path-specific limit, the reference shows a request URI condition using the Contains operator:

{
  "matchVariable": "RequestUri",
  "operator": "Contains",
  "matchValue": [
    "login"
  ]
}

It selects URIs containing login. Microsoft also says that a rate limit needs at least one match condition and that separate limits can apply to different paths.

To match all requests, Microsoft's rate-limit page describes a condition in which the Host header has a length greater than 0. Because valid Azure Front Door HTTP requests contain a Host header, that condition matches all HTTP requests.

What does Azure Front Door group together?

The documented grouping key is the socket IP address. Microsoft defines it as the address of the client that initiated the TCP connection to Azure Front Door. It is commonly the user's IP address, though it can be the address of a proxy or another device between the user and Front Door. Clients arriving from different socket IP addresses receive separate rate limits.

The threshold applies to each socket IP group over a one minute or five minute period. Azure Front Door WAF uses a fixed time period. Once a matching group's threshold is breached, all traffic matching that rate-limit rule is blocked for the remainder of that fixed window.

The server path matters to enforcement precision. Requests from one client often reach the same Front Door server, where the limit is reached for that client IP. A new TCP connection can instead reach another server whose counter has not refreshed. Microsoft says that this can allow the first request to the new server through, especially with a low threshold such as less than about 200 requests per minute.

How should threshold and priority be read?

The threshold controls the request count for each socket IP group. Microsoft says that a larger window with the smallest acceptable request-count threshold is the most effective configuration for preventing DDoS attacks because a group that reaches the threshold remains limited for the rest of the window. The same documentation says larger windows, such as five minutes, and larger thresholds, such as 200 rather than 100, tend to enforce closer to the configured threshold than shorter windows and lower thresholds.

Priority controls the order in which custom WAF rules are evaluated. A lower number runs before a higher number. The evaluation stops for an action other than Log, so a preceding rule can determine whether later rules receive the request.

Related terms

• How do I apply a Cloudflare WAF rule to one URL path?
• How does Cloudflare evaluate the order of custom WAF rules?
• How do I create a skip rule in Cloudflare's WAF?

FAQ

Does Azure Front Door group rate-limit requests by the URL?

The documented counter is grouped by socket IP address. The URL belongs in the match condition when a limit should apply to a path, such as a request URI that contains login.

Can one rule cover all website traffic?

Yes. Microsoft documents a match condition based on a Host header length greater than 0; because valid Azure Front Door HTTP requests contain that header, the condition matches all HTTP requests.

Why can traffic exceed the configured threshold?

Requests from one client can reach different Azure Front Door servers, and a new server might not have refreshed its counter. Microsoft gives less than about 200 requests per minute as an example of a low threshold where some requests above the threshold might pass.

Sources

1. Microsoft Learn, "Custom rules for Azure Web Application Firewall on Azure Front Door", 8 October 2026
2. Microsoft Learn, "WAF Rate Limiting for Azure Front Door", 25 February 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer