Azure Front Door WAF creation fails and Microsoft.Network/AllowFrontdoor requires approval

Question

Azure Front Door WAF creation fails and Microsoft.Network/AllowFrontdoor requires approval

Kris 0

We are unable to deploy an Azure Front Door Premium Web Application Firewall

policy.

The subscription feature Microsoft.Network/AllowFrontdoor reports:

Approval type: ApprovalRequired
Registration state: Pending

The ARM/Bicep deployment successfully validates, but actual creation of

Microsoft.Network/FrontDoorWebApplicationFirewallPolicies fails with:

"WebApplicationFirewallPolicy validation failed.

Policy ArmResourceId has incorrect formatting."

We reproduced the problem with:

Our full Azure Front Door deployment
A minimal standalone WAF policy with no Front Door association
API versions 2025-11-01 and 2020-11-01
Minimal, managed-rule-only, and custom-rule-only policy configurations

Both Microsoft.Network and Microsoft.Cdn resource providers are registered.

All other Front Door resources deploy successfully.

This appears to require subscription-level feature approval or backend

resource-provider investigation. Could a Microsoft engineer please escalate

this to a private Azure support case and contact me privately? I can provide

the subscription ID, tenant ID, resource IDs, correlation IDs, service request

IDs, deployment names, and sanitized deployment logs through the private

channel.

The application is currently deployed using an origin restriction that only

permits AzureFrontDoor.Backend traffic with the matching X-Azure-FDID. WAF

deployment is temporarily disabled until this issue is resolved.

Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator

2026-07-13T23:07:33.0233333+00:00
Hello Kris

From the symptoms you shared, the deployment is failing specifically during creation of Microsoft.Network/FrontDoorWebApplicationFirewallPolicies with:

“WebApplicationFirewallPolicy validation failed. Policy ArmResourceId has incorrect formatting.”

Your subscription feature shows Microsoft.Network/AllowFrontdoor with ApprovalRequired and Registration state: Pending.

You can try with below command.

Azure CLI

az feature registration create --namespace Microsoft.Network --name AllowFrontdoor

Please try creating the resource using the commands below:

To manage Azure Front Door Standard/Premium resource, use az afd CLI command.

To manage Classic Azure Front Door resource, use az network front-door CLI command.

Please "upvote" if the information helped you. This will help us and others in the community as well.

1 answer

Your answer

Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator

2026-07-13T23:07:33.0233333+00:00

Hello Kris

From the symptoms you shared, the deployment is failing specifically during creation of Microsoft.Network/FrontDoorWebApplicationFirewallPolicies with:

“WebApplicationFirewallPolicy validation failed. Policy ArmResourceId has incorrect formatting.”

Your subscription feature shows Microsoft.Network/AllowFrontdoor with ApprovalRequired and Registration state: Pending.

You can try with below command.

Azure CLI

az feature registration create --namespace Microsoft.Network --name AllowFrontdoor

Please try creating the resource using the commands below:

To manage Azure Front Door Standard/Premium resource, use az afd CLI command.

To manage Classic Azure Front Door resource, use az network front-door CLI command.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer 1

Hi Kris, your minimal reproduction is useful because it removes the Front Door association and still fails. A feature registration in Pending with approval required cannot be fixed by repeatedly deploying or changing the API version. Check the registration once with az feature show --namespace Microsoft.Network --name AllowFrontdoor; if it remains pending, open a Network/Front Door support case and provide the feature state, failed deployment operation, correlation ID, WAF resource ID, region, and UTC time privately. The ArmResourceId has incorrect formatting message may be the backend validation symptom rather than your Bicep string. Keeping the origin locked to the Front Door service tag plus matching FDID is a sensible temporary control, but it is not a replacement for WAF.