Preserve Front Door WAF overrides when changing a managed ruleset

Source facts

Assigning a new managed ruleset through the Azure portal resets the existing managed-rule customizations to the new ruleset’s defaults. Microsoft specifically includes rule states, actions, and rule-level exclusions, while saying custom rules and policy settings are unaffected.

Microsoft directs owners who need to retain overrides and exclusions to change the version through PowerShell, CLI, REST, or a template, then validate the changes before production deployment. Microsoft Learn.

Applicability

Review the actual Front Door policy, current managed ruleset, proposed version, and chosen change tool. Keep managed-rule overrides distinct from separate custom rules so the impact comparison uses the correct configuration objects.

DSE recommendation

DSE recommends a reviewed customization inventory with an owner and reason for each exception. Decide which overrides still belong in the new version instead of copying them without assessment. Preserve the previous policy and test plan, then choose the change method that matches the approved retention decision.

Verification

Apply the planned change to a test policy. Compare effective rule states, actions, and exclusions against the approved inventory, and exercise representative legitimate requests and approved security tests. Investigate unexpected blocking or newly broad exceptions before rollout. Record both the ruleset version and the resulting customization set in the release evidence.

Official references

Microsoft Learn: Azure Web Application Firewall DRS rule groups and rules. Source retrieved September 9, 2026.