Azure Front Door

What it is

Azure Front Door is a global, Layer 7 content-delivery and web-routing service. It accepts internet-facing HTTP(S) traffic at Microsoft’s edge network, then uses configured routes and origin health to deliver static or dynamic content. It can provide caching, TLS termination, and a Web Application Firewall (WAF).

Why it exists

Global web applications benefit when users connect to a nearby edge point and static content can be served without every request crossing the world to an origin. Front Door also provides a single global entry point that can route around an unhealthy origin.

Key ideas

• A profile exposes endpoints and routes. A route selects an origin group and origins, while health probes help Front Door avoid unhealthy origins.
• Front Door can route by host and path, terminate TLS at the edge, manage certificates, and use rules at the edge. It supports both static caching and dynamic content delivery.
• A WAF policy can be attached to protect web traffic. It complements—not replaces—application validation, authentication, authorization, and monitoring.
• Front Door can use Private Link for supported private-origin designs. Confirm tier, origin type, and network requirements before treating an origin as private.
• Standard and Premium feature sets differ. Use the current tier comparison for a design or price decision instead of assuming a feature exists in every tier.

How it fits

[users]  →  [Azure Front Door edge (global anycast)]
                │  L7 + WAF + SSL + caching
                │  configured routes + origin health
        ┌───────┴────────┐
   [origin A region] [origin B region]

Diagrams courtesy of Microsoft Learn / Azure docs: frontdoor/front-door-overview

Northwind example

Northwind has public ordering origins in two regions. Front Door accepts customer traffic at an edge location, caches suitable public product images, and routes dynamic checkout traffic to a healthy origin according to its configured route and priority/weight design. If a health probe marks one origin unhealthy, Front Door can stop sending that route’s traffic there. The order database remains protected by its own private network, identity, and data controls; Front Door does not make the entire workload globally resilient by itself.

Front Door versus other delivery services

Requirement	Start by considering
Global, internet-facing HTTP(S) delivery, routing, and optional caching	Azure Front Door
Regional Layer 7 routing inside or close to a virtual network	[[application-gateway
Global DNS response routing without proxying each HTTP request	[[traffic-manager
Regional Layer 4 TCP or UDP balancing	[[load-balancer

These services can appear in the same architecture. Pick each from the traffic path and failure boundary it must control.

Common confusion

• Front Door is a proxy service for web traffic; it is not simply a DNS record or a generic load balancer for arbitrary TCP/UDP workloads.
• Caching requires deliberate cache rules and suitable content. Do not cache personalized or sensitive responses without understanding the consequences.
• A successful edge response does not prove every origin dependency or authenticated operation is healthy.

Related

Home · traffic-manager · application-gateway · load-balancer · azure-dns · azure-firewall

Sources and re-audit

• Microsoft Learn — What is Azure Front Door?, checked 2026-09-16.