You have an web app in Azure App Service. You want to protect it using web application firewall (WAF) policy. What should you do?