Application Gateway

Name: Application Gateway
Brand: Microsoft
Rating: 4.4 (170 reviews)

Application Gateway is Microsoft Azure's managed Layer 7 (HTTP/S) load balancer and application delivery controller that provides regional, VNet-injected L7 routing, TLS termination, health probing, session affinity, and an optional Web Application Firewall.

Est 1975|Valuation $2888.5B|Raised $72.9B

LinkedIn 29.0M|Website|Web traffic 1233.4M|FTEs 232,851|HQ Redmond, Washington, US

MarketsWeb Application & API Protection (WAAP)Firewalls

Platform CoversInfrastructure Monitoring

Published Oct 14, 2026

01Common complaints

- When the primary requirement is global edge delivery and WAF close to end users - Azure Front Door Premium or Cloudflare are often more aligned for edge WAF and global anycast acceleration. - When extreme cost sensitivity or only basic TCP/UDP load balancing is required - Azure Load Balancer (L4) or simpler reverse proxy solutions can be less expensive for small or low-throughput workloads. - Community discussions indicate that AppGW can be perceived as expensive for specific regions/SKUs and smaller deployments. - When deep, appliance-grade ADC features are required (advanced traffic scripting, highly granular WAF controls, complex legacy patterns) - F5 BIG-IP VE may provide the required feature depth but introduces appliance operations and licensing complexity. - When an organization lacks bandwidth for day-2 operations - WAF tuning, certificate lifecycle management, and troubleshooting can be recurring operational burdens. - When a simple Kubernetes ingress with minimal Azure-specific overhead is desired - Alternative ingress controllers or managed gateway patterns may be simpler; Microsoft’s "Application Gateway for Containers" is a different product family with distinct control and data planes that may suit AKS-specific use cases. - Platform lifecycle constraints - AppGW v1 is retired as of April 28, 2026; customers must use v2 SKUs. - Observability limitations (user-reported) - Some users report diagnostic fields that do not provide sufficient detail to identify which backend instance produced an error. - Common operational pitfalls - 502 and timeout behaviors related to backend response-time mismatches are frequently cited in troubleshooting contexts. - IaC and configuration management - Terraform and module ergonomics are recurring complaint themes in community discussions. - Roadmap perception - Some community members express uncertainty about relative product investment compared with Front Door; this represents community perception and should be validated directly with the vendor.

Deal disqualifiers (poor fit)

Cost-sensitive small workloads where an L4 load balancer or simpler ingress suffices.
Primary requirement for global edge acceleration/caching; other edge-focused solutions may be more appropriate.
Need for advanced ADC/WAF features comparable to dedicated appliances without operational trade-offs.

02Why they buy

- Observed differentiators based on customer and ecosystem signals - Common selection factors include fit for hub-and-spoke and private backend exposure patterns because AppGW is deployed into a VNet. - Integration with Azure Monitor diagnostics and standard Azure governance constructs (RBAC, Policy) simplifies adoption within Azure-centric organizations. - Caveat - Many differentiators are primarily relevant within Azure; in multi-cloud contexts, edge providers and appliance vendors may provide broader feature sets or different trade-offs.

Why customers chose AppGW over alternatives (recurring themes)

Tight integration with Azure networking and VNet-injected ingress for private backend integration.
L7 routing (host/path-based) without managing a custom reverse proxy fleet.
WAF option available within the same service for teams that prefer not to operate a separate WAF appliance.

03Field reports

Customer Testimonials

Review platforms show mixed sentiment: AppGW is widely used, and user sentiment varies depending on whether teams use it primarily as an L7 router or as a security/WAF platform.

Gartner Peer Insights (listing exists; some content may require login/subscription)

Gartner Peer Insights lists end-user reviews for Azure Application Gateway; full review text may require organization-level access.
Visible snippets describe AppGW as a Layer 7 load balancing / ADC-like service.

TrustRadius

TrustRadius shows above-average ratings with a modest review footprint.
TrustRadius summaries commonly cite:
- Pros: efficient load balancing and WAF functionality.
- Cons: cost, complexity, and operational friction (especially WAF tuning and troubleshooting).

G2

G2 reviewers typically note Azure-native integration and L7 routing features, while some reviews highlight complexity and pricing concerns.

PeerSpot

PeerSpot lists AppGW reviews and comparisons, with practitioner commentary about mTLS and security features.

Community (Reddit) — direct quotes (positive and negative)

- Cost complaints - A thread titled “Why is the azure application gateway so damn costly??” illustrates that higher-than-expected costs are a common concern for smaller workloads or cost-sensitive teams. - WAF false positives / tuning frustration - A thread comparing WAF experiences across clouds notes false positives and exclusion-management burdens. - Architectural tradeoffs vs Front Door - Multiple threads compare Front Door and Application Gateway, noting that Front Door can be preferable for global edge scenarios while AppGW is more suitable for regional, VNet-integrated patterns. - Limitations / perceived known limitations - Community comments reference known limitations with v2 in certain scenarios and describe common workarounds such as splitting listeners/domains or using API Management / Front Door for specific requirements. - Logging gaps - A thread titled “Application Gateway Logging Weirdness” reports that some users expected more detailed diagnostic fields than were available even after enabling diagnostics.

Why some customers leave or consider alternatives (recurring themes)

Baseline costs for always-on gateways compared with simpler L4 load balancing or edge-provider bundles.
WAF tuning burden and false positives.
Feature gaps compared with edge/CDN platforms (global anycast, caching, bot management) unless combined with Front Door or a CDN.
IaC ergonomics and day-2 operations challenges.

Case Studies

- Microsoft publishes product content and architectural guidance; many published case studies are vendor-oriented and may lack independent verification. - Practical, evidence-backed mini case studies from community sources: - Community walkthrough shared via forums - A community member posted a walkthrough demonstrating external HTTP plus internal HTTPS exposure of a service behind AppGW, including private CA certificate usage. This is technical implementation detail rather than a business ROI case study. - 502 / timeout-style incidents - Third-party vendor forum posts describe application-unreachable symptoms caused by backend timeout mismatch (default timeout behavior). These are anecdotal but reflect a recurring operational pitfall. - Metrics and ROI validation - Vendor claims about scalability and availability typically require workload-specific benchmarking and independent validation; buyers should treat performance and ROI figures as dependent on workload characteristics unless independently benchmarked.

04Best fit

Company sizes

Typically mid-market to enterprise (companies with multiple hundreds to many thousands of employees).
Organizations with centralized platform/network teams managing shared ingress for many applications.
Smaller organizations may use AppGW, but cost and complexity concerns are more frequently reported in smaller-scale contexts.

Industries

Common in regulated or security-conscious sectors using Azure, such as financial services, healthcare, government contractors, and SaaS providers.
Any Azure-heavy enterprise needing private backend ingress and L7 routing.

Roles and personas

Decision makers: cloud/network architects and security architects (when WAF is in scope), platform engineering leaders.
End users: SRE and DevOps engineers implementing routing, certificate management, and monitoring.

Pain points addressed

Managed L7 load balancing and routing without operating reverse proxy fleets.
WAF integrated into Azure networking patterns.
Secure exposure of private backends.

Qualification criteria (good fit)

Azure-first or Azure-only deployments.
Need for regional, VNet-injected L7 ingress.
Adequate operational maturity to handle WAF tuning, logging, and IaC.

05The pitch

What the product does (core value proposition in objective terms)

- Azure Application Gateway (AppGW) is Microsoft Azure’s managed Layer 7 (HTTP/S) load balancer / application delivery controller (ADC) for routing web traffic to backends such as VMs, VM scale sets, App Service (in some architectures), and other endpoints. - It is commonly used for TLS termination, host/path-based routing, health probes, session affinity, and (when enabled) Web Application Firewall (WAF) protection. - Microsoft describes the product as a service intended to enable application-layer routing and delivery control for web front ends.

Target market and market positioning

- Primarily mid-market to enterprise Azure customers that require regional (VNet-integrated) L7 ingress with optional WAF. - Often appears in hub-and-spoke network designs where workloads sit behind private IPs and AppGW provides controlled ingress. - AppGW competes with: - Global edge services (Azure Front Door) - Third-party edge/WAF providers (Cloudflare) - Virtual appliances (F5 BIG-IP VE) - Other cloud L7 load balancers (AWS ALB for AWS-native workloads)

Get a comprehensive analysis of Application Gateway including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →