# Azure Web Application Firewall Default Ruleset 2.2 reaches GA

> The new managed ruleset adopts OWASP CRS 3.3.4 across Application Gateway and Front Door, with an upgrade caveat for custom exclusions.

Canonical URL: https://www.devobs.io/news/news-azure-waf-default-ruleset-2-2-ga/
By: Arjun Shah
Published: 2026-09-06T11:58:54.638Z
Updated: 2026-09-06T11:58:54.638Z
Event date: 2026-04-29
Section: Security

Azure Web Application Firewall Default Ruleset 2.2 became generally available across Application Gateway and Front Door. Microsoft's [network security post](https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/general-availability-of-default-ruleset-drs-2-2-for-web-application-firewall/4515762) says DRS 2.2 is based on OWASP Core Rule Set 3.3.4 and contains 18 rule groups. Paranoia-level 1 rules are enabled by default; level 2 rules remain disabled or selective.

## A managed ruleset is still a behavior change

New detections can block requests that passed the previous ruleset, while revised signatures may stop flagging old patterns. The impact depends on each application’s payloads, exclusions, and enforcement mode. A version upgrade therefore belongs in the release process, with request samples and ownership for false positives.

Microsoft warns that upgrading through the portal resets rule overrides and exclusions. CLI, PowerShell, REST, or infrastructure templates are the safer path when existing customizations must be retained.

## Preserve and test policy state

Export the current WAF policy before changing versions. Record disabled rules, action overrides, exclusions, and associations with gateways or Front Door profiles. Recreate the policy in a test environment through the same deployment mechanism used in production.

Run representative traffic in detection mode and review matched rule IDs, request fields, and application outcomes. Include large bodies, file uploads, encoded paths, and API clients that differ from browsers. Promote enforcement in stages, watching both WAF logs and upstream error rates.

Finally, make the ruleset version explicit in code. A managed update should be reviewable as a policy change, and emergency exclusions should carry an owner and expiry date rather than becoming permanent undocumented exceptions.

## Source references

- <https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/general-availability-of-default-ruleset-drs-2-2-for-web-application-firewall/4515762>