We're a small business handling roughly 200,000 requests per day, but we recently experienced short Layer 7 DDoS bursts involving several million requests. I configured WAF rate limits, but they didn't help much because the traffic came through many edge locations and each edge appeared to maintain its own counter. Lowering the limits further would risk blocking legitimate customers.
We upgraded to Front Door Premium to use the managed WAF rules and DDoS-related protections, but the additional request charges could still make future attacks very expensive. I'm now considering alternatives such as Cloudflare or Akamai, or possibly using Application Gateway instead of Front Door.
Has anyone dealt with this situation? Are there specific Front Door WAF, bot-management, caching, or geo-filtering settings that actually help, and is there any possibility of getting attack-related charges reviewed or credited?
4 Answers
Make sure the default managed ruleset and bot protection ruleset are enabled at the Front Door profile level. Premium gives you access to those protections, but they still need to be configured. Geo restrictions and carefully tuned custom rate limits can help too. Cloudflare tends to enable more protection out of the box, so it’s worth comparing the total cost and how much configuration you want to maintain.
A common approach is to put Cloudflare or Akamai in front of Azure and use each service for a clearly defined purpose. For example, keep caching and optimization in one CDN rather than enabling both layers, and restrict the Azure origin so it only accepts traffic from the upstream provider. In some cases, replacing Front Door entirely with a third-party CDN plus Azure Firewall or Application Gateway is simpler and cheaper.
If Front Door isn’t providing a feature you actually need, Application Gateway combined with another security or CDN provider may be a better fit. Front Door’s configuration propagation and WAF behavior can be frustrating for smaller teams, and a third-party service may offer more predictable bot controls and pricing. I’d compare the architecture and billing model during a controlled migration rather than relying only on the premium managed rules.
Caching as much content as possible can protect the origin even when the WAF doesn’t stop every request immediately. It won’t eliminate edge request charges, but it can reduce the impact on your applications. Also check whether your provider has an attack-cost mitigation or credit process; Azure DDoS Protection customers have sometimes had attack-related charges reviewed, but you’d need to confirm eligibility with support for your specific setup.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures