Azure Front Door is a global, Layer 7 load balancer and web application delivery service. It provides global routing, TLS termination, DDoS protection integration, caching, and more—making it an ideal “front door” for internet-facing applications.
What is Azure Front Door?
Azure Front Door (AFD) is a cloud-native, globally distributed service that routes user traffic to the most appropriate backend based on configured routing rules, health probes, and policies. It operates at the HTTP/HTTPS (Layer 7) level and consolidates features such as:- Global routing and failover
- TLS termination and certificate management
- Web Application Firewall (WAF) integration
- Caching and CDN-like acceleration
- DDoS protection and rate limiting integrations
- URL path–based routing and header rewrites
- HTTP/3 (QUIC) support for lower-latency connections
When to choose Azure Front Door vs Application Gateway
Use Azure Front Door when you need a global entry point and want to optimize routing across multiple regions, provide cross-region failover, or accelerate content delivery for a global user base. Use Application Gateway when you need a region-scoped Layer 7 load balancer with deeper integration into a specific virtual network or when you need features tightly coupled with regional Azure resources.Important: Azure Front Door is a global service. If your architecture requires private VNet-only origin connections without additional networking configuration, Application Gateway (regional) or Private Link-enabled Backends may be more appropriate. Consider security boundaries, cost, and compliance when choosing the right entry point.
Key benefits and capabilities
- Global routing and acceleration: Route users to the nearest or healthiest backend to minimize latency.
- Security: WAF integration, TLS termination, and integration with Azure DDoS Protection.
- High availability: Built-in health probes and global failover reduce downtime.
- Performance: Caching and HTTP/3 support improve responsiveness for global users.
- Flexible origins: Support for App Service, Storage, custom hosts (VMs, on-prem), CDN origins, and third-party endpoints.
- Automation: Deployable via Azure Portal, Azure CLI, ARM templates, Bicep, or Terraform.
Standard vs Premium SKUs — feature comparison
| Capability | Standard SKU | Premium SKU |
|---|---|---|
| Layer 7 load balancing | ✓ | ✓ |
| Web Application Firewall (WAF) | Managed rules, custom rules | Advanced WAF features and extended rule sets |
| Private Link integration | — | ✓ (enables private connectivity to backends) |
| Advanced security features | Basic WAF and rate-limiting | Additional security controls and policy granularity |
| Price / cost profile | Lower | Higher (for advanced features) |
| Use case | Global load balancing + CDN-like features | Enterprise scenarios requiring private origins, advanced WAF, and finer security controls |
Design and deployment considerations
When designing an Azure Front Door deployment for production, consider the following:- DNS and TLS
- Use CNAMEs to map custom domains to Front Door endpoints.
- Use managed certificates for simplified TLS, or upload certificates stored in Azure Key Vault for custom certificate management.
- Routing and rules
- Use path-based routing to direct requests to different backend pools (e.g., /api/* to API backends, /static/* to storage).
- Implement secure redirection rules (HTTP → HTTPS) and host header rewrites as required.
- Backend configuration
- Define backend pools with origins (App Service, Storage, custom hostname).
- Configure host headers, priority/weight for traffic distribution, and backend-specific health probes.
- Health probes
- Use health probes to detect backend health; set probe intervals, path, and expected status codes that match your application behavior.
- Security and WAF
- Tune WAF rules to avoid false positives during rollout; use logging and metrics to iterate.
- Monitoring and diagnostics
- Enable metrics, logging, and diagnostic settings (e.g., Azure Monitor, Log Analytics) to track performance, errors, and WAF events.
- Deployment automation
- Automate with ARM/Bicep, Azure CLI, or Terraform for repeatable deployments and CI/CD integration.
Typical deployment steps (high-level)
- Plan DNS records and certificate requirements.
- Create an Azure Front Door instance (Standard or Premium) via Portal, CLI, or IaC.
- Define frontend hosts (custom domains and default endpoint).
- Create backend pools and add origins (App Service, Storage, VMs, etc.).
- Configure routing rules and URL path–based rules.
- Set up health probes for each backend.
- Enable WAF policies and tune rule sets.
- Validate traffic flows and failover scenarios.
- Monitor and adjust based on telemetry.
Configuration topics covered in this lesson
- Choosing a SKU and mapping feature requirements to Standard vs Premium
- Deploying Front Door with custom domains and TLS termination
- Defining backends, host headers, and origin types (App Service, Storage, custom host)
- Creating routing rules and URL path-based routing
- Implementing secure redirects and HTTP/3 (QUIC) support
- Creating and tuning health probes to improve availability
- Applying and managing SSL/TLS certificates, including Key Vault integration
- Instrumenting with Azure Monitor and diagnostic logs
- Understand the purpose and benefits of Azure Front Door as a global entry point for web applications.
- Compare features and capabilities of the Standard and Premium SKUs to choose the right one for your scenario.
- Learn deployment options, including HTTP/3 (QUIC) support and automation methods (Portal, CLI, ARM/Bicep, Terraform).
- Configure routing rules, URL path–based routing, and secure redirection (for example, HTTP to HTTPS).
- Define backend endpoints, configure host headers, and choose between different origin types (App Service, Storage, custom host, etc.).
- Configure and customize health probes to monitor backend health and improve availability.
- Apply and manage SSL/TLS certificates to enable secure end-to-end connections.
Links and references
| Resource | Use |
|---|---|
| Azure Front Door documentation | Official docs, concepts, and quickstarts |
| Azure Front Door Standard/Premium overview | SKU differences and feature lists |
| Azure Web Application Firewall documentation | WAF policies and managed rules |
| Azure Front Door pricing | Pricing details and comparisons |
| Create Front Door with Bicep | Example IaC templates |