Does an Azure Application Gateway WAF v2 rate limit of 600/minute effectively behave as 10 requests/second?

Krista Scerri 40 Reputation points
2026-08-06T14:48:09.23+00:00

I have a rate-limiting custom rule on Application Gateway WAF v2: threshold 600 requests, duration 1 minute, grouped by client IP, action Block.

From the WAF/access logs, when a single IP's request rate spiked from ~4 req/s to ~12 req/s, requests started getting throttled (429) even though the trailing-60-second request count for that IP was only 200, well under the configured 600.

Conversely, later in the same event I saw a second where the trailing-60s count was over 600 but nothing was throttled because that particular second's rate was low (~10 req/s).

So it looks like throttling tracks the instantaneous rate rather than the full 60-second count reaching 600 i.e. 600/minute is effectively enforced as ~10/second.

Is that correct?

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

Answer accepted by question author

AI answer

2026-08-06T14:48:26.6066667+00:00

No. On Application Gateway WAF v2, a rate limit of 600 requests per 1 minute is not documented as a fixed 10 requests/second limit.

What is documented:

  • Application Gateway WAF v2 rate limiting uses a sliding window algorithm.
  • The threshold is defined as the number of requests allowed within the specified time period.
  • In the first window where the threshold is breached, additional matching traffic is dropped.
  • From the second window onward, traffic up to the configured threshold within the window is allowed, which creates a throttling effect.
  • With GroupByUserSession = ClientAddr, the threshold is counted independently per source IP address.

So the supported interpretation is:

  • 600/minute means evaluation against a rolling 1-minute window per client IP, not a separate documented per-second cap.
  • The behavior is based on the sliding window logic, so enforcement does not have to align with simple second-by-second math such as “10 per second.”

The observed pattern described in the logs is not enough to conclude that Application Gateway WAF converts 600/minute into an instantaneous 10 req/s rule. The documented behavior is a sliding 60-second window, not a fixed per-second limiter.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.