Application Gateway WAF v2: Knowing When You've Hit the Ceiling
AppGW v2 scales to 125 instances. That's not a hard wall — it's a signal to add Front Door above and shard.
Azure Application Gateway v2 (and WAF_v2) is the standard regional L7 in hub-and-spoke designs. Two numbers matter for capacity planning:
- Each instance handles up to 10 Capacity Units.
- Instance count scales 0 to 125.
That's a per-AppGW ceiling. When traffic for one workload approaches it, you don't fight the limit — you go horizontal.
The Microsoft-recommended pattern
"If your traffic requirement needs more than 125 instances, you can use Azure Traffic Manager or Azure Front Door in front of your Application Gateway."
— Application Gateway docs
So the layering becomes:
Front Door (global, anycast, 190+ POPs)
↓
Multiple AppGW shards (regional, WAF_v2, ≤125 instances each)
↓
Backends (AKS / App Service / VMs)Alerting that actually fires in time
Set capacity alerts at 50% average, 75% peak on the
CapacityUnits and ComputeUnits metrics. Default scale-up
takes a few minutes — alerting at 90% means you've already throttled real
users. The docs literally say so:
"Alert if Compute Unit utilization crosses 75% of average usage."
Also: zone-redundant deployment is free. Always pick zones 1+2+3 unless your region doesn't support it.