Azure WAF pricing — what it actually costs

People search for "the price of Azure WAF" and come away confused, because there isn't one. The WAF is a feature bolted onto a bigger thing you're already paying for — and that bigger thing, not the WAF, is where your money goes.

New to cloud? CAMPUX is a free, build-first course. Start here →

Azure WAF has no single price — it is billed as part of whatever fronts it. On Application Gateway WAF v2 you pay a fixed hourly gateway charge plus capacity units; on Front Door you pay per WAF policy, per managed or custom rule, and per million requests inspected. The honest qualifier the pricing pages bury: the gateway or Front Door base cost usually dwarfs the WAF add-on, so budgeting for "the WAF" alone will mislead you.

I get this question from students almost every week, and it comes in wearing the wrong frame. They ask "how much is Azure WAF per month" as if WAF were a product with a sticker on it, like a VM size. It isn't. Web Application Firewall is a capability you switch on in front of an application, and it always rides on a host service — either Application Gateway or Front Door. You never buy WAF by itself. You buy the fronting service, and WAF is a surcharge and a set of metered rules layered onto that bill. Once you see it that way, the pricing stops being mysterious and starts being arithmetic.

Two products called WAF, two very different bills

Azure sells WAF on two host services, and they meter it in genuinely different ways. This is the single fact that clears up most of the confusion.

Application Gateway WAF v2. Application Gateway is a regional layer-7 load balancer. It comes in a Standard v2 SKU and a WAF v2 SKU; choosing WAF means you run the WAF SKU. Billing has two moving parts: a fixed gateway charge billed per hour just for the gateway existing, and capacity units that scale with the work it does — connections, throughput, and rule processing. The WAF inspection is folded into those capacity units. There is no separate "per request" line. You pay for the gateway to be on, and you pay for how hard it works.

Front Door WAF. Front Door is a global edge service — CDN, routing, and TLS termination at Microsoft's edge. Its WAF is billed as an add-on to a Front Door Standard or Premium profile, and the WAF meter itself has three parts: a charge per WAF policy per month, a charge per rule (managed rule sets and your custom rules), and a charge per million requests the WAF inspects. So Front Door genuinely does bill WAF partly by request volume, where Application Gateway does not.

That difference — capacity units on one side, per-request on the other — is why the same app can cost more on one than the other depending on how much traffic it takes and whether it's regional or global.

The cost table, dated and hedged

Below is how the two break down. Every figure here is approximate, for US regions, as of 2026, and rounded to convey the shape rather than a quote. Azure changes list prices, regions differ, and your capacity and traffic swing the total more than any single rate does. Treat the direction as reliable and the exact numbers with suspicion — then price your own case in the Azure Pricing Calculator, which is the only source that reflects today's rates for your region.

Rates: Azure Pricing pages for Application Gateway and Front Door, cross-checked against the Azure Pricing Calculator, Aug 2026. Rounded and region-averaged — not a quote.

Roughly what a small app costs per month

Let me work one example, because a table of components is still abstract until you add it up. Say you have a modest single-region production web app — a company site with a login, steady but unremarkable traffic, a few million requests a month. You put an Application Gateway WAF v2 in front of it. Again, these are ballpark 2026 figures, not a bill:

• Fixed gateway hour: roughly $0.30/hour × ~730 hours ≈ $220/month. This is the floor; it's there whether anyone visits or not.
• Capacity units: say it holds around 3 CUs on average → 3 × $0.008 × 730 ≈ $18/month.
• All-in: on the order of $240/month for that app, before data transfer.

Now notice the shape of that number. The "WAF" part — the security inspection you came here to price — is buried inside a capacity-unit line that's about $18. The other $220 is the gateway existing. If that same app already needed an Application Gateway for load balancing, then the true marginal cost of turning WAF on is the gap between the Standard v2 and WAF v2 SKU rates, which is a fraction of the whole — not the $240.

Run the same app through Front Door instead and, for light traffic, you might land lower — a $35 base plan, a $5 policy, a handful of $1 rules, and under a dollar of per-million-request charges — but you'd move to Premium (an order of magnitude more on the base fee) the moment you want the full managed rule sets, and a busy global app's per-request line can climb past what the gateway would have cost. There is no universal winner. There is only your traffic pattern, modelled in the calculator.

The number you were looking for — "the price of the WAF" — is the smallest line on the invoice. The service under it is the bill.

The honest gap: the WAF line item is not your cost problem

Here is the part the pricing pages won't frame for you, and it's the whole reason this article exists. When people try to cut cost on a WAF setup, they reach for the wrong lever. They see "WAF" in the SKU name, assume that's the expensive bit, and start economising on the security itself. It's backwards.

Your real cost drivers, in order, are usually: the fronting service (the gateway hour or the Front Door plan), then data transfer / egress once traffic is real, and only then the WAF rules and inspection. The WAF surcharge is genuinely small next to those two. So if the monthly bill is uncomfortable, the savings live in right-sizing the gateway, consolidating multiple gateways behind one, tuning autoscale bounds, and getting a handle on egress — not in touching the firewall.

Which brings me to the false economy I see most: flipping the WAF from Prevention mode to Detection mode "to save money." Detection mode does not save you a meaningful amount — the WAF is still deployed, still inspecting, still billed. What you lose is the blocking. You keep paying for a firewall and quietly turn off the part that stops attacks, so it becomes a very expensive logging system. If budget pressure ever tempts you there, the right move is to right-size the host service, not to defang the security you're already paying for. That is the difference between a cloud engineer who reads a bill and one who reacts to a word in it.

How to decide, quickly

If you want a rule of thumb before you open the calculator: a single-region app with steady traffic usually reasons more cleanly on Application Gateway WAF v2 — one fixed appliance, one predictable floor. A global, spiky, or low-volume app, or one that already wants a CDN, usually fits Front Door WAF better, because you pay closer to what you use and the edge comes bundled. If you're weighing the two host services in general, not just the WAF part, that's its own decision worth reading up on — see Front Door versus Application Gateway. And if you're still deciding whether you need a WAF at all versus a plain firewall, Azure Firewall versus WAF draws that line.

Whatever you pick, price it against your own traffic in the Azure Pricing Calculator before you commit a number to anyone. The rates in this article are the shape of the answer. The calculator is the answer.

Common questions