I have Azure Front Door, with WAF Policy. I have created one WAF rule to accept traffic only from Denmark. We need to make Azure Load Testing, which hits the endpoint domain to the Front Door, it runs from Sweden Central. The solution is also hosted on Sweden Central.

Of course, the test fails because it is not allowed, so the only way to fix this is by adding Sweden to the rule.

My Question: is there a way to allow Azure Load Testing service or Azure Services to bypass the firewall without allowing All Sweden public addresses?

Here is the current working custom rule:

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2024-02-01' = {
  name: frontDoorFWPolicyName
  tags: tags
  sku: {
    name: frontDoorSkuName
  }
  location: 'global'
  properties: {
    policySettings: {
      mode: 'Prevention'
      requestBodyCheck: 'Enabled'
      enabledState: 'Enabled'
    }
    customRules: {
      rules: [
        {
          name: 'GeoLocation'
          action: 'Block'
          matchConditions: [
            {
              matchValue: [
                'DK', 'SE'
              ]
              matchVariable: 'SocketAddr'
              operator: 'GeoMatch'
              negateCondition: true
            }
          ]
          priority: 100
          ruleType: 'MatchRule'
        }
      ]
    }
    managedRules: {
      managedRuleSets: []
    }
  }
}