How to apply WAF policy to Front door?

Question

I have created the following resources in Azure portal:

1. Function App (API to read data from BD and retrieves responses)
2. API Management service (to handle basic API security)
3. Front Door and CDN profiles (to make API security better)
4. Front Door WAF policy (to apply specific security rules)

Question is how to apply created own WAF policy (item 4) into Front door (item 3) as WAF policy cannot be selected in Front door->Front Door and CDN profiles? It says 'No existing policies in the current subscription'.

Pease see two print screens:

I tried to create Front Door in different settings/offerings but no success.

Answer 1

With help of Azure support team, the following solution has been found. When creating Web Application Firewall resource in Azure, the following settings needs to be applied:

• Basic tab:
  • policy for: Classic !!!VERY IMPORTANT!!!
  • policy name: choose some name
  • policy mode: Prevention
• Managed rules: select your preferred Default rule set
• Association:
  • click Associate a Front Door profile and select FD you created earlier i.e. some-name.azurefd.net

That should apply WAF policy to Front desk.

Answer 2

Check the tier you have selected to add existing WAF Policies are also created in same tier (standard or premium)

I have created 4 WAF Policies of different tiers and types: 3 Policies belongs to Front Door and are of Classic, Standard and Premium Global Policies. 1 Policy belongs to Regional (Application Gateway) WAF Policy.

• Classic Global WAF Policy is visible only in Azure Front Door (Classic) Resource creation.
• Standard and Premium Global WAF Policies are visible only in Azure FD profiles based on your Tier Selection.

Updated Answer:

• Created APIM Service in Premium Tier as a host origin to the FD Profile.

Standard FD & Standard WAF Policy:

Premium FD Profile with Premium WAF Policy:

Using Azure Sponsorship Subscription: