403 Forbidden Microsoft-Azure-Application-Gateway/v2

Hello Pat DeMarco,

Greetings!

Thanks for raising this question in the Q&A forum.

The message you're seeing, "403 Forbidden - Microsoft-Azure-Application-Gateway/v2," is not something coming from your own computer, browser, or account. It's a server-side error generated by your bank's website, which happens to be hosted behind Azure Application Gateway (a Microsoft cloud service that sits in front of many websites to manage traffic and security). A 403 Forbidden response means the Application Gateway's Web Application Firewall (WAF) or access rules blocked your specific request before it ever reached the bank's actual banking application.

Since this gateway is owned and configured entirely by your bank's IT team, and not by you, there are unfortunately no settings on your end within Azure that you can change to remove this message. However, there are a few things worth trying and checking:

Try basic client side fixes first This kind of block is sometimes triggered by something in the request itself rather than a real threat. Try the following:

• Clear your browser cache and cookies for the bank's site, then try again
  • Try a different browser or an incognito/private window
    • Try from a different network (for example, switch from public Wi-Fi to your home network, or vice versa), since some WAF rules block certain IP ranges or VPNs
    Disable any VPN, proxy, or ad blocker temporarily WAF rules on Application Gateway commonly flag traffic coming through VPNs, proxies, or unusual headers injected by browser extensions. Disable these temporarily and retry. Wait and retry If the bank recently pushed a change to their WAF policy or is mid deployment, the block can sometimes be temporary and resolve within a few hours. Contact your bank's support or IT team directly This is the most important step. Since the Application Gateway and its WAF rules belong to your bank, only they can see why your specific request was blocked and adjust the rule if it was a false positive. When you contact them, mention:

    - The exact error message: 403 Forbidden, Microsoft-Azure-Application-Gateway/v2
    
       - The approximate date and time you saw it
    
          - The page or action you were trying to perform (for example, logging in, viewing an account, making a transfer)
    

This information helps their engineers trace the specific WAF rule that triggered the block in their logs.

For reference, here is Microsoft's documentation on how Application Gateway WAF works, which you're welcome to share with your bank's support team if it helps speed things up: Azure Web Application Firewall on Application Gateway

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.