> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Install the Azure Front Door Enforcer

If your organization uses Azure Front Door, you can use HUMAN's Azure Front Door Enforcer to protect against malicious behavior, which dictates how traffic should be handled per your organization's standards. The Azure Enforcer combines Azure's Front Door CDN caching functionality with the Azure Function App's ability to run serverless code in the cloud.

![](/_fern-img/2c4c67da743fb21afca10f6a4ca3ce95156ce4ca257060100881eb6009392e22.webp)

1. The client sends a request to Azure Front Door.
2. Front Door sends the incoming request to the Function App origin group.
   1. Reduces Function App invocations in the case of First Party requests.
3. If the Enforcer in the Function App passes the request, the Azure Function proxies the request back to the same Front Door domain.
4. If not found in the cache, the Front Door Rule Set sends the request to the origin server.

You can learn how to install the Azure Front Door Enforcer with this article.

> **Note**
>
> This process uses the [Deploy Tool](/applications/general/deploy-tool), HUMAN's recommended method for installing and updating the Enforcer. If you prefer a manual method, see our [manual installation article](/applications/azure-front-door/manual-installation).

## Prerequisites

* An **Azure subscription** with at least a **Contributor** role and the following providers:
  * `Microsoft.Cdn` (for Front Door)
  * `Microsoft.Storage` (for Storage Accounts)
  * `Microsoft.Sites` (for App Service)
  * `Microsoft.Resources` (for Resource Groups)
  * `Microsoft.Web` (for Function Apps)
* A supported **Azure app service plan** on the same **region** you want to deploy your Enforcer to. The supported plans are:
  * Basic
  * Standard
  * Premium
  * Isolated
* An **Azure resource group** within the relevant subscription.
* Docker or Script, depending on your preferred method to run the deploy tool.
  * For Docker, see how to install Docker Desktop with their [documentation](https://docs.docker.com/get-started/get-docker/).
  * For Script, install the following:
    * [Node.js 18.x or later and npm 10.x or later](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
    * [Git CLI](https://git-scm.com/downloads)
    * [GNU Wget](https://www.gnu.org/software/wget/)
* An Enforcer configuration file, `enforcerConfig.json`, which you can download from the **Platform Settings > Enforcers**, clicking on the appropriate Enforcer, and clicking **Download configuration file** . This file has the basic information for Enforcer functionality, such as your **Application ID** and remote authorization token, already filled in. Be sure to save it in a directory you’ll remember, like `/deploy`.

## Create a Service Principal Client Secret

The Enforcer requires a **client secret** from a Service Principal. If you have an existing one, you can use it to create a secret. If you don’t have one, you can follow the steps to create a new one.

### Create a new Service Principal

1. Follow the steps in Microsoft’s help article section [Register an application with Microsoft Entra ID and create a service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#register-an-application-with-microsoft-entra-id-and-create-a-service-principal). While doing so, make sure that you do the following for the specified fields:
   * **Name**: Choose a descriptive name (e.g. "Human Security Enforcer Deploy Tool")
   * **Supported account types**: Select "Accounts in this organizational directory only"
   * **Redirect URI**: Leave blank
2. After registering your Service Principal, note the **Client (Application) ID** and **Tenant (Directory) ID**. You’ll need these values later.

### Create a client secret

1. Follow the steps in Microsoft’s help article section [Option 3: Create a new client secret](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret).
2. After you create the client secret, be sure to **copy and save it in a secure place.** You will not be shown the secret again.

## Run the Deploy Tool

First, download and run the Deploy Tool. You can do this by either pulling a Docker image or running a script.

#### Docker method

> **Additional setup for Windows users**
>
> If you're using Windows, you also need to complete additional steps to set up Docker:
>
> 1. In your Windows search bar, search for and open **Turn Windows features on or off**.
> 2. Find the **Windows Hypervisor Platform** feature and click its checkbox to enable it.
> 3. Click **OK** to save your changes.
> 4. Open **Windows PowerShell** as an Administrator.
> 5. Copy and paste in `C:\Windows\System32\wsl.exe --update --web-download`, then hit Enter.

1. Pull the Docker image by running:

```bash
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

2. Navigate to the directory where you saved `enforcerConfig.json`.
3. Run the Deploy Tool with the following:

```bash
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

#### Script method

1. Navigate to the directory where you created `enforcerConfig.json`.
2. Pull the HUMAN Deploy Tool zip from Google Artifact Registry using:

**`Windows`**

```shell title="Windows"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_win:1.7.1:cdn-enforcer-deploy-tool_win.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

**`Mac and Linux`**

```shell title="Mac and Linux"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_unix:1.7.1:cdn-enforcer-deploy-tool_unix.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

3. Unzip `cdn-enforcer-deploy-tool.zip` to the same directory you saved `enforcerConfig.json` in.
4. Navigate to the folder you unzipped and double click the script file to run the Deploy Tool. Depending on your operating system, the folder and script file are named differently:
   * **Windows**: Open the `cdn-enforcer-deploy-tool_win` folder and double click `run.bat`.
   * **Mac or Linux**: Open the `cdn-enforcer-deploy-tool_unix` folder and double click `run.command`.

## Deploy the Enforcer

After you run the Deploy Tool, you'll be prompted with steps to deploy the Enforcer.

1. When prompted, select **Azure Front Door** and hit **Enter.**

```bash
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
? Which platform do you want to deploy to? (Use arrow keys)
  ...
❯ Azure Front Door
  ...
```

2. Follow the prompts that appear to complete the setup process.
3. After you complete the setup, confirm that the displayed details are correct, then enter `y` to deploy the Enforcer.