You need to implement the planned change for WAF1.

Add a custom WAF rule . The planned change requires WAF1 to implement rate limiting based on the geographic location of incoming requests . Azure Web Application Firewall supports this combination directly through custom rate-limit rules.

Microsoft documents that Application Gateway WAF rate-limit rules can group requests by GeoLocation , where requests are categorized based on the geographic location derived from the client IP address. The rule can then apply the configured rate threshold independently to traffic originating from each geographic location. Microsoft Learn Azure WAF custom rules also support the GeoMatch operator, which evaluates requests according to their country or region of origin. Microsoft Learn

This makes a single custom rule the most direct and administratively efficient implementation.

The Azure-managed Default Rule Set (DRS) provides predefined protections against common web application attacks, such as injection and protocol attacks; it is not where custom geographic rate limits are defined. Bot Manager 1.1 identifies and handles automated bot traffic but is not the appropriate mechanism for general location-based rate limiting. Azure Policy can enforce configuration standards across resources but does not itself process web requests or impose per-location request thresholds.

Therefore, configure a custom rate-limit rule with geographic matching/grouping .

===============