Ensure that Bot Protection for Azure Application Gateway WAF policy is enabled.
Azure Web Application Firewall (WAF) for Application Gateway provides bot rules to block or log requests from known malicious IP addresses identified through the Microsoft Threat Intelligence feed. Enabling the bot manager rule set reduces exposure to automated attacks that scrape, scan and search for application vulnerabilities.
Modify Application Gateway WAF policy and add the bot manager rule set in managed rules.