Application Gateway and WAF errors — 502, unhealthy backends, certificates, WAF 403s, Key Vault certificates and subnet rules
Why Azure Application Gateway (v2) returns 502 or 504, marks backends Unhealthy, or blocks requests with 403 — the verbatim backend health messages (timeouts, DNS, TCP connect, status and body mismatch, certificate chain, CN, unknown CA), the management ports its subnet NSG must allow, App Service backends and host headers, API Management probe paths, WAF anomaly scoring and rule 949110, Key Vault certificate errors by identity and network, and the 2026 status of v1 and old TLS policies.
markdownreferencev10K4Q-8BY8stage: operatetrust: officialservice: application-gatewayinterface: anyApplication Gateway 502Application Gateway 504backend health UnhealthyTime taken by the backend to respond to application gateway's health probe is more than the timeout threshold in the probe setting.Application Gateway could not connect to the backend.Application Gateway could not create a probe for this backend.Status code of the backend's HTTP response didn't match the probe setting.Body of the backend's HTTP response didn't match the probe setting.The Common Name of the leaf certificate presented by the backend server does not match the Probe or Backend Setting hostnameIntermediate certificate is missingServer certificate isn't signed by a well-known Certificate AuthorityBackend server certificate isn't allow-listed with Application Gateway.The backend health status could not be retrieved.ports 65200-65535 GatewayManagerApplicationGatewaySubnetInboundTrafficBlockedByNetworkSecurityGroupApp Service backend pick host nameAPI Management probe /status-0123456789abcdefWAF 403rule 949110 anomaly score 5Detection modePrevention modeUserAssignedIdentityDoesNotHaveGetPermissionOnKeyVaultKeyVaultHasRestrictedAccessSecretDeletedFromKeyVaultKeyVaultSoftDeletedApplication Gateway v1 retired April 28 2026
Application Gateway and WAF errors
Application Gateway v1 retired on April 28, 2026: everything here is v2 (Standard_v2, WAF_v2). TLS 1.0 and 1.1 were removed from its TLS policies in 2025; use a current predefined or custom policy. Start every 502 with backend health:
az network application-gateway show-backend-health -g <rg> -n <agw> \
--query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{address:address, health:health, log:healthProbeLog}" -o tableBackend health messages (v2)
| Message | Cause → fix |
|---|---|
Time taken by the backend to respond to application gateway's health probe is more than the timeout threshold in the probe setting. | Slow backend or probe path: make the path cheap, or raise the probe timeout |
Application Gateway could not create a probe for this backend. This usually happens when the FQDN of the backend is not entered correctly. | Wrong FQDN, or the gateway's VNet DNS can't resolve it (private endpoints need the zone linked to the gateway's VNet) |
Application Gateway could not connect to the backend. Check that the backend responds on the port used for the probe. Also check whether any NSG/UDR/Firewall is blocking access to the Ip and port of this backend. | Nothing listening on that port, or an NSG, UDR or firewall between gateway subnet and backend |
Status code of the backend's HTTP response didn't match the probe setting. Expected:{…} Received:{…}. | The probe path returns 401, 403, 404 or a redirect. Point the probe at an anonymous health path, or widen the accepted status codes. API Management backends: probe /status-0123456789abcdef |
Body of the backend's HTTP response didn't match the probe setting. … | The probe's body match string isn't in the response |
The Common Name of the leaf certificate presented by the backend server does not match the Probe or Backend Setting hostname of the application gateway. | The host name the gateway sends (backend setting or probe) differs from the certificate's CN/SAN. For App Service, use pick host name from backend target |
The Intermediate certificate is missing … / The Leaf certificate is missing … / The Leaf certificate isn't the topmost certificate … | The backend serves an incomplete or misordered chain: fix the chain on the server |
The backend Server certificate isn't signed by a well-known Certificate Authority (CA). … / … not signed by any root certificates uploaded … | Private CA: upload its root to the backend setting's trusted root certificates |
Backend certificate is invalid. Current date isn't within the "Valid from" and "Valid to" date range on the certificate. | Expired backend certificate |
Backend server certificate isn't allow-listed with Application Gateway. | The authentication or trusted root certificate on the backend setting doesn't match the server's |
The backend health status could not be retrieved. … | The gateway subnet's NSG or UDR blocks the management range (inbound 65200–65535 from GatewayManager on v2), or the backend FQDN doesn't resolve. v2 refuses such an NSG rule with ApplicationGatewaySubnetInboundTrafficBlockedByNetworkSecurityGroup |
502 when backends look healthy
- The request goes somewhere the probe doesn't: a different host header, path or listener/rule misconfiguration.
- Asymmetric routing: the response returns through an NVA, firewall or gateway route instead of the gateway.
- Capacity:
CapacityUnitsat the autoscale ceiling; raise the maximum. - App Service backends: host-header mismatch, or App Service access restrictions that don't allow the gateway's subnet (service endpoint) or IP.
- Empty pool, or the gateway stopped or in a
Failedprovisioning state. - 504: the backend took longer than the backend setting's request timeout.
WAF 403s
The 403 body names Microsoft-Azure-Application-Gateway/v2. With the OWASP Core Rule Set, the WAF uses anomaly scoring: matching rules add to a score, and at 5 or more the request is blocked (Prevention mode) or only logged (Detection mode). Rule 949110 is that threshold, not the cause: find the contributing rules for the same transaction ID in the WAF logs, then add a scoped exclusion (a request header, cookie, argument or body field) or a per-rule override. Typical false positives: sign-in forms with ' or --, JSON bodies with HTML or SQL-like words. Don't turn the policy off or switch everything to Detection.
Key Vault certificates on listeners
| Error code | Cause → fix |
|---|---|
UserAssignedIdentityDoesNotHaveGetPermissionOnKeyVault | The gateway's user-assigned identity needs Key Vault Secrets User (RBAC vault) or secret get (access policy vault) |
KeyVaultHasRestrictedAccess | The vault firewall blocks the gateway: allow trusted services, or use a private endpoint the gateway's VNet resolves |
SecretDisabled / SecretDeletedFromKeyVault / KeyVaultSoftDeleted | The secret or vault is disabled or deleted: re-enable, recover, or point at a new secret ID |
UserAssignedManagedIdentityNotFound | The identity was deleted: assign a new one with access |
ApplicationGatewaySslCertificateDataMustBeSpecified | A listener certificate has neither data nor a Key Vault secret ID |
Use a versionless secret ID so renewals are picked up. Key Vault rules: reference/keyvault/access-and-errors.md.