Configure Cloudflare Web Application Firewall with Microsoft Entra External ID

WAF provider configuration

1. Sign in to the Microsoft Entra admin center as at least a Security Reader.
2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the external tenant you created earlier from the Directories + subscriptions menu.
3. Browse to Entra ID > Security Store.
4. Select the Protect apps from DDoS with WAF tile by selecting Get started.
5. Under Choose a WAF Provider select Cloudflare and then select Next.

6. Under Configure Cloudflare WAF, you can select an existing configuration or create a new one. If you're creating a new configuration add the following information:
   • Configuration name: A name for the WAF configuration.
   • API token: The API token from your Cloudflare dashboard.
   • Zone ID: The Zone ID for your ___domain, from your Cloudflare dashboard.

7. Select Next to save your changes.

Domain verification

Select the custom URL domains that are enabled through Azure Front Door (AFD) to verify and connect them to your Cloudflare WAF configuration. This step ensures that the selected domains are protected with advanced security features.

1. Select Verify ___domain to start the verification process.
2. Select the custom URL domains you want to protect with Cloudflare WAF and then select Verify.

3. After verification, select Done.

You can use the Microsoft Graph API through Graph Explorer to configure the Cloudflare WAF integration.

Make sure the caller has the Security Reader role and has consented to the RiskPreventionProviders.Read.All permission.

Step 1: Create Cloudflare WAF provider with the API

Make sure that you have the API token you created in Cloudflare and the Zone ID for your ___domain. This information is required so the backend can call Cloudflare on your behalf to pull and verify the WAF configuration.

Request

The following example shows a request to create a new Cloudflare WAF object.

POST https://graph.microsoft.com/beta/identity/riskPrevention/webApplicationFirewallProviders
Content-Type: application/json
{
    "@odata.type": "#microsoft.graph.cloudFlareWebApplicationFirewallProvider",
    "displayName": "Cloudflare Provider Example",
    "zoneId": "11111111111111111111111111111111",
    "apiToken": "cf_example_token_123"
}

Response

The following example shows the response with Cloudflare WAF object.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json
{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/riskPrevention/webApplicationFirewallProviders/$entity",
    "@odata.type": "#microsoft.graph.cloudFlareWebApplicationFirewallProvider",
    "id": "00000000-0000-0000-0000-000000000001",
    "displayName": "Cloudflare Provider Example",
    "zoneId": "11111111111111111111111111111111"
}

Step 2: Verify Cloudflare WAF provider with the API

The following example shows how to verify a webApplicationFirewallProvider using the hostName.

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProviderId}/verify
Content-Type: application/json
{
  "hostName": "www.contoso.com"
}

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json
{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.webApplicationFirewallVerificationModel",
    "id": "00000000-0000-0000-0000-000000000000",
    "verifiedHost": "www.contoso.com",
    "providerType": "cloudflare",
    "verificationResult": {
        "status": "success",
        "verifiedOnDateTime": "2025-10-04T00:50:26.4909654Z",
        "errors": [],
        "warnings": []
    },
    "verifiedDetails": {
        "@odata.type": "#microsoft.graph.cloudFlareVerifiedDetailsModel",
        "zoneId": "11111111111111111111111111111111",
        "dnsConfiguration": {
            "name": "www.contoso.com",
            "isProxied": true,
            "recordType": "cname",
            "value": "contoso.azurefd.net",
            "isDomainVerified": true
        },
        "enabledRecommendedRulesets": [
            {
                "rulesetId": "22222222222222222222222222222222",
                "name": "CloudFlare Managed Ruleset",
                "phaseName": "http_request_firewall_managed"
            }
        ],
        "enabledCustomRules": [
            {
                "ruleId": "33333333333333333333333333333333",
                "name": "Block SQL Injection",
                "action": "block"
            },
            {
                "ruleId": "44444444444444444444444444444444",
                "name": "Block XSS",
                "action": "block"
            }
        ]
    }
}