Application Gateway - 1

2026 (4)

March (1)

azure: [Launched] Generally Available: Default Rule Set 2.2 and updates to ruleset support policy

Azure Updates

2026-03-17

Azure WAF has made Default Rule Set (DRS) 2.2 generally available on Azure Application Gateway and Azure Front Door. The managed ruleset support policy is being updated to reflect this release and provide more predictable support guidance.

February (3)

azure: [In preview] Public Preview: WAF Insights for Application Gateway

Azure Updates

2026-02-23

Azure Application Gateway WAF Insights is now in public preview, adding an interactive view of WAF logs and metrics. It is intended to help investigate blocked requests and analyze attack patterns.

azure: [In development] Public Preview: X-Forwarded-For (XFF) grouping for rate limiting on Application Gateway WAF v2

Azure Updates

2026-02-03

Azure Application Gateway WAF v2 now offers Public Preview support for additional rate‑limiting GroupBy options that use the X‑Forwarded‑For (XFF) HTTP header, enabling better client identification when the gateway is behind proxies or CDNs.

azure: [Launched] Generally Available: Default Ruleset 2.2 in WAF for Azure Application Gateway

Azure Updates

2026-02-02

Microsoft announced the general availability of Default Rule Set (DRS) 2.2 for Web Application Firewall (WAF) on Azure Application Gateway. The Azure-managed rule set provides active protection against common web vulnerabilities and exploits and includes Microsoft Threat Intelligence.

2025 (8)

December (1)

azure: [Launched] Generally Available: FIPS compliant mode for Application Gateway V2 SKUs

Azure Updates

2025-12-09

Azure Application Gateway V2 SKUs are now generally available with a FIPS 140-2 compliant mode, allowing customers to use FIPS-validated cryptographic modules to help meet US government and regulatory cryptography requirements.

November (5)

azure: [Launched] Generally Available: TLS and TCP termination on Azure Application Gateway

Azure Updates

2025-11-19

Azure Application Gateway is generally available with support for TLS and TCP termination, enabling load balancing and secure processing of non-HTTP(S) traffic.

azure: [Launched] Generally Available: Azure Application Gateway mTLS passthrough support

Azure Updates

2025-11-18

Azure Application Gateway now generally supports mTLS passthrough, enabling backend applications to receive client certificates and authorization headers for their own validation while still using the Web Application Firewall for traffic inspection.

azure: [In preview] Public Preview: Microsoft HTTP DDoS Ruleset 1.0 on Application Gateway WAF v2

Azure Updates

2025-11-18

Microsoft announced the public preview of the HTTP DDoS Ruleset 1.0 for Application Gateway WAF v2. The ruleset is designed to help mitigate evolving HTTP-layer DDoS and botnet-driven attacks that can bypass static controls.

azure: [In preview] Public Preview: JWT Validation in Azure Application Gateway

Azure Updates

2025-11-18

Azure has announced a public preview of JSON Web Token (JWT) validation in Azure Application Gateway, allowing authentication and token validation to occur at the gateway before requests reach backend applications or APIs.

azure: [In preview] Public Preview: Application Gateway for Containers Istio Service Mesh integration

Azure Updates

2025-11-18

Application Gateway for Containers is in public preview for integration with the Istio service mesh via an optional service mesh extension, enabling simplified secure north–south communication between external clients and services inside the mesh.

October (1)

azure: [Launched] Generally Available: Enhanced cloning and Public IP retention scripts for Azure Application Gateway migration

Azure Updates

2025-10-20

Azure released two PowerShell scripts to simplify migrating Application Gateway from V1 (Standard or WAF) to V2 (Standard_V2 or WAF_V2): an enhanced cloning script and a public IP retention script. V1 SKUs are scheduled for retirement in April 2026, so customers are advised to migrate early to V2 and take advantage of its features.

September (1)

azure: [Launched] Generally Available: Using Server-sent events with Application Gateway

Azure Updates

2025-09-22

Azure Application Gateway now generally supports Server-sent events (SSE), enabling real-time server-to-client data streaming over a persistent HTTP connection for seamless client updates.