Merge pull request #308510 from halkazwini/waf-custom

WAF AppGw custom response

Author: JamesJBarnett

articles/web-application-firewall/ag/configure-custom-response-code.md

@@ -6,7 +6,7 @@ author: YaakobiEden
 ms.author: edenyaakobi
 ms.service: azure-web-application-firewall
 ms.topic: how-to
-ms.date: 08/24/2025
+ms.date: 11/19/2025
 ---
 
 # Configure custom response code and body for Azure Application Gateway WAF
@@ -15,6 +15,10 @@ By default, when Azure Web Application Firewall (WAF) on Azure Application Gatew
 
 This article shows you how to configure a custom response page when Azure Application Gateway's Web Application Firewall (WAF) blocks a request using the Azure portal. You can also configure custom responses using the [Azure CLI](/cli/azure/network/application-gateway/waf-policy/policy-setting) or [PowerShell](/powershell/module/az.network/new-azapplicationgatewayfirewallpolicysetting).
 
+> [!IMPORTANT]
+> Custom response in Azure Application Gateway Web Application Firewall (WAF) is currently in PREVIEW.
+> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
+
 ## Configure a custom response status code and message
 
 To customize the response status code and body, take the following steps:
@@ -33,8 +37,19 @@ In this example, we changed the default 403 response code to 429 and set a brief
 
 :::image type="content" source="../media/configure-custom-response-code/application-gateway-custom-response.png" alt-text="Screenshot that shows a custom response example.":::
 
+## Limitations
+
+The following limitations apply when configuring custom responses for Azure Application Gateway WAF:
+
+- You can enable up to 20 WAF policies with custom block response status code and body within one Application Gateway.
+- You can use one of the following custom status codes: 200, 403, 405, 406, 429, 990, 991, 992, 993, 994, 995, 996, 997, 998, 999.
+- The maximum size for the custom block response body is 32KB.
+- You must use base64 encoding for the custom block response body when you use Azure Resource Manager (ARM) API.
+- Custom block response status code and body aren't supported on Application Gateway for Containers WAF.
+
 ## Related content
 
 - [Azure Web Application Firewall policy](policy-overview.md)
 - [Create Web Application Firewall policies for Application Gateway](create-waf-policy-ag.md)
 - [Azure Web Application Firewall on Application Gateway](ag-overview.md)
+