Cloudflare WAF joins Azure AD B2C for custom-domain protection
Cloudflare and Microsoft have released an integration that lets Azure Active Directory B2C customers place their custom authentication domains behind Cloudflare’s Web Application Firewall (WAF). The setup steps are documented on Microsoft’s Azure documentation site, and Microsoft has also announced the partnership on its tech community blog. All that is required to get started is a Cloudflare account.
What the WAF brings to the table
The Cloudflare WAF is a core part of the Cloudflare platform and blocks over 70 billion threats each day — roughly 810,000 per second.
Rules can be authored through the Cloudflare dashboard or via Terraform. Every request is evaluated against the rule engine and threat intelligence built from protecting roughly 25 million internet properties. Depending on the rule configuration, suspicious requests are blocked, challenged, or logged while legitimate traffic continues on to the origin — whether that origin sits on-premise or in the cloud. Analytics and Cloudflare Logs provide visibility into the traffic patterns.
Azure AD B2C: customer identity as a service
Azure AD B2C is a customer identity management service for sign-up, sign-in, and profile management across iOS, Android, .NET, single-page applications, and other web experiences. It relies on standard authentication protocols including OpenID Connect, OAuth 2.0, and SAML, and lets organizations brand the entire user flow to match their web and mobile applications.
The service works with most modern applications and commercial off-the-shelf software, delivering business-to-customer identity as a service. Users can authenticate with social, enterprise, or local account identities to get single sign-on access to applications and APIs. Microsoft handles the scaling and security of the authentication platform, including monitoring and automated responses to denial-of-service, password spray, and brute-force attacks.
Putting the custom domain behind the WAF
Many Azure AD B2C customers want their authentication endpoint on their own domain — for example, store.example.com — instead of a Microsoft-owned one. With this integration, customers can host that custom domain behind Cloudflare’s WAF while still using Azure AD B2C. The combined setup gives identity services an extra layer of protection against sophisticated attacks.
The approach is defense-in-depth: Cloudflare WAF capabilities work alongside Azure AD B2C’s native Identity Protection features to guard against cyberattacks.
What customers gain
Once Azure AD B2C is in place, customers need strong security and performance tooling around it. The Cloudflare WAF integration enables custom security rules, rate limiting, DDoS mitigation, and advanced bot management. Traffic destined for the application is proxied and inspected, with payloads analyzed to ensure only non-malicious content reaches origin servers. That covers the OWASP Top 10 and other vectors such as zero-day exploits and malicious botnets.
