We tried WAF prevention mode in 9.0.2 (9.0.1 should also work) and made it work in the end.
Imp: Sitecore 9.1 won't magically fix it as MS itself is struggling to expose variables to customize Azure WAF parameters.
so we disabled this rule and the ones below. Keep in mind that 'post' goes through a log checking of its content(body), especially if there is a form that accepts upload(pdf or pics). It is pointless to check all the contents of upload, so we disabled the inspect request body.
We only need this for CD. So just do proper testing and monitor the WAF logs(first in detection mode, in PROD). Run this query in Monitor-> Logs and chill.
search in (AzureDiagnostics) ResourceType == "APPLICATIONGATEWAYS" and
Resource == "<RG NAME>" | sort by TimeGenerated desc
| where Category == "ApplicationGatewayFirewallLog"
| where Message like "SQL Injection Attack"
| where clientIp_s == "<IP of machine doing testing>" //optional