Azure Front Door Standard WAF creation fails while AllowFrontdoor remains Pending

Emil Kanneworff 0 Reputation points
2026-08-15T16:04:56.4133333+00:00

I cannot create an Azure Front Door Standard WAF policy.

The Azure subscription is enabled. I have Owner access. Microsoft.Network and Microsoft.Cdn are Registered.

After requesting the feature registration, this remains Pending:

Microsoft.Network/AllowFrontdoor

Creating Microsoft.Network/FrontDoorWebApplicationFirewallPolicies fails with:

WebApplicationFirewallPolicy validation failed. More information "Policy ArmResourceId has incorrect formatting".

I reproduced the failure with a minimal, unassociated Standard_AzureFrontDoor WAF policy created directly through Azure Resource Manager. It has no custom rules, certificate, route, Front Door association, DNS change, App Service restriction, or Key Vault dependency.

The Azure Front Door Standard profile itself is Active. Endpoint, origin group and origin deploy successfully; the WAF policy alone fails.

Could Microsoft confirm whether AllowFrontdoor requires manual approval for the subscription, or escalate this to a private support case? I can provide subscription, deployment and correlation details privately.

Azure Front Door
Azure Front Door

An Azure service that provides a cloud content delivery network with threat protection.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Emil Kanneworff 0 Reputation points
    2026-08-15T20:31:42.95+00:00

    Thank you. We have no active paid Azure Support Plan, so the Azure portal only directs us to Microsoft Q&A.

    Could a Microsoft moderator please help escalate this as a subscription-level Azure Front Door WAF provisioning issue, or provide a private channel where I can share the subscription ID, failed deployment/correlation ID, WAF resource ID and UTC timestamps?

    The failure is reproducible with a minimal standalone Standard_AzureFrontDoor WAF policy and no Front Door association.

    Was this answer helpful?

    0 comments
  2. Allan Solomon Mejia 6,240 Reputation points
    2026-08-15T19:59:38.45+00:00

    Hello @Emil Kanneworff

    Based on what you’ve tested, this does not look like a malformed WAF policy configuration. The important indicators are:

    • Microsoft.Network and Microsoft.Cdn are already registered.
    • The Azure Front Door Standard profile and its endpoint/origin resources deploy successfully.
    • Even a minimal standalone Microsoft.Network/FrontDoorWebApplicationFirewallPolicies resource fails.
    • Microsoft.Network/AllowFrontdoor remains Pending.

    There have been other reports showing the same combination of AllowFrontdoor = Pending and “Policy ArmResourceId has incorrect formatting” during WAF policy creation.

    I would first confirm the feature state:

    az feature show \
  --namespace Microsoft.Network \
  --name AllowFrontdoor \
  --query "{state:properties.state,approvalType:properties.approvalType}"

    If it remains Pending, repeatedly registering the feature or recreating the WAF policy is unlikely to resolve the underlying issue.

    Also, ApprovalRequired by itself does not necessarily mean that WAF creation should be blocked; Microsoft moderators have reported environments where the feature shows ApprovalRequired but WAF policies can still be created.

    Given that your minimal reproduction also fails, I’d recommend opening an Azure Network / Front Door support request so Microsoft can inspect the subscription-level feature state and backend WAF provisioning operation. Provide the subscription ID, failed deployment/correlation ID, WAF resource ID, UTC timestamp, and the AllowFrontdoor feature output privately.

    This appears more consistent with a subscription/backend provisioning issue than an error in your WAF ARM resource ID.

    Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.