Application Gateways using legacy WAF configuration — upgrade to WAF policy before Mar 15, 2027

AzureDeprecations & retirementsTeam planSeverity: highazure.application-gateway

Application Gateway WAF v2 gateways still using the legacy WAF configuration, which retires on March 15, 2027

What LeftSize checks

WAF configuration (the legacy, inline webApplicationFirewallConfiguration) on Application Gateway WAF v2 retires on March 15, 2027. Microsoft isn't making further investments in WAF configuration; upgrade to a WAF Policy at no extra cost.

Why it matters

Missed retirement and end-of-support dates turn into forced upgrades, outages or extended support charges at a moment you did not choose.

What you get in the GitHub issue

LeftSize runs this check from a scheduled GitHub Action with a read-only identity in your Azure account and opens one issue per scope, updated on every scan. The issue includes:

  • The affected resources, grouped per subscription, resource group or account and region
  • Background on why it was flagged and when it is a false positive
  • Step-by-step remediation with safety checks
  • Cost and operational impact of fixing it
  • Ready-to-run fix scripts (CLI, PowerShell or Terraform where available)
  • Alternative approaches and their trade-offs
  • Snooze, ignore or report a finding with a comment on the issue
Install LeftSizeIncluded in the Team and Business plans.

Official references