one Traffic manager and multiple DNS mapping (pls need clarification on how security is ensured)

@Travis Roberts  Thanks for your inputs....but I couldn't find any option in Traffic Manager to SSL bind and restrict the traffic there itself. Am I missing anything?

I see we have SSL binding option only at - Application Gateway (HTTPS Listener) and WebApp.

In my case, I did SSL bind at AGW HTTPS listener by uploading PFX. We thought we will go with SSL off-loading at AGW, so I thought of not adding SSL again at WebApp.

Hope that's the right setup where there is

TM for routing requests in HA setup > 

(followed by) App Gateway with WAF enabled (to apply security) & SSL off Load

(followed by) Azure WebApp to serve the request.

Not sure, at least why AGW is not blocking the connections as we did SSL bind at HTTPS listener.

Pls help!!