WAF Policy

■

Use the current managed rule set (Microsoft Default Rule Set or OWASP CRS 3.2 or later).

■

Start in Detection mode. Use UMP-365 for a few days: sign in, open the pages, run a bulk upload and export. Afterwards, read the WAF logs for rules that are applied on normal UMP-365 traffic.

■

Add exclusions for the rules only, scoped to the request part and path where they are applied. Bulk CSV uploads in particular can trigger SQL injection and other rules on their content.

■

Set the maximum request body and file upload size to at least the anticipated size of the largest bulk CSV file.

■

Switch to Prevention mode.

■

Add a custom rule that blocks internet access to the following path/authenticate/swagger . The Customer portal publishes its API description to this path in every environment.