Azure Web Application Firewall
An Azure service that provides protection for web apps.
Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 6%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
Elisa
0
Reputation points
Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement
Azure Web Application Firewall
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 12%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERT%3C/text%3E%3C/svg%3E)
Ravi Teja M 540 Reputation points2025-10-23T10:12:39.54+00:00 Hello Elisa,
The reason the Azure portal setting "Enforce maximum request body limit" does not directly correspond to the JSON property
properties.policySettings.requestBodyEnforcementis that the user interface option bundles together two distinct but related JSON properties:-
requestBodyEnforcement: This is a simple boolean (true/false) property that determines whether the Web Application Firewall (WAF) should enforce any request body size limits at all. -
maxRequestBodySizeInKb: This integer property specifies the maximum allowable request body size in kilobytes.
When you toggle the single "Enforce maximum request body limit" setting in the Azure portal, it manages both of these properties behind the scenes.
How the portal setting maps to the JSON properties
The Azure portal offers a simplified experience, abstracting the details of the underlying REST API and JSON structure. The "Enforce maximum request body limit" checkbox performs the following logic:
**Portal setting ** requestBodyEnforcement(boolean)maxRequestBodySizeInKb(integer)Checked (enabled) trueThe value specified in the adjacent "Maximum request body size" field. Unchecked (disabled) falseThe value is not applicable and is ignored. In this case, the WAF does not block requests based on body size, and the maximum is determined by the Application Gateway's higher limits (up to 4 GB). This separation provides granular control via the API (PowerShell, CLI, or Bicep) but a more user-friendly experience in the portal.
Why the JSON properties are separate
Having separate JSON properties for enforcement and the limit offers increased flexibility, especially for advanced use cases.
- Granular control: By decoupling the "on/off" switch (
requestBodyEnforcement) from the size limit itself (maxRequestBodySizeInKb), administrators can independently control the behavior. - Performance vs. Security: For newer WAF engines (CRS 3.2 or newer), size enforcement can be enabled or disabled independently of request body inspection. This gives you the flexibility to prioritize performance (by disabling enforcement) or security (by keeping it enabled).
- Backward compatibility: For older WAF policies (Core Rule Set 3.1 or lower), request body inspection and size enforcement were linked. The separate JSON properties accommodate this by making the size field inapplicable if inspection is turned off.
Regards,
Raviteja M.
-
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 42%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPR%3C/text%3E%3C/svg%3E)
Priya ranjan Jena 1,510 Reputation points Microsoft External Staff Moderator2025-10-23T11:48:24.07+00:00 Hi Elisa,
Welcome to Microsoft Q&A forum.
To understand the difference between Enforce maximum request body limit & WAF policy json property is as below:
- Portal/UI setting: "Enforce maximum request body limit" is a friendly label shown in the Azure Portal for clarity. It indicates whether the WAF should enforce the configured maximum request body size for inspection.
- JSON property:
properties.policySettings.requestBodyEnforcementis the actual schema property in the WAF policy ARM template or REST API. This is the authoritative configuration key used by Azure Resource Manager
Both refer to the same logical feature:
- When enabled, WAF enforces the maximum request body size limit (e.g., 128 KB for OWASP CRS).
- When disabled, WAF does not block requests exceeding the limit; it only inspects up to the limit
- Azure Portal uses descriptive labels for usability.
- ARM schema uses technical property names for consistency across APIs and automation.
This separation between properties allows for better flexibility in policy management. You can control inspection and enforcement independently, which gives you more options for performance optimization or security configurations based on your specific scenarios.
Hope, you find this comment helpful, if yes, please “up-vote” for the information provided , this can be beneficial to community members.
Kindly let us know if you have any additional questions.
Thanks
Sign in to comment
Sign in to answer