TopolearnFront Door is how global apps get low latency, edge security and multi-region failover in one service.
Azure Front Door (Standard and Premium tiers) is a global, anycast layer-7 entry point running at Microsoft's edge locations. It terminates TLS close to the user, then routes over the Microsoft backbone to your origins. It is also Azure's CDN: the Azure CDN classic offerings are being retired in favor of it.
Configuration objects:
- Endpoint: the
*.azurefd.nethostname, plus your custom domains with managed certificates. - Origin groups: origins (App Service, Container Apps, storage, public IPs) with health probes, priorities and weights for active/active or active/passive multi-region routing.
- Routes: match domains and paths to an origin group, with caching and compression settings.
- Rule sets: header rewrites, redirects, URL rewrites, cache overrides.
- WAF policy: managed OWASP rule sets, bot protection (Premium), rate limits, geo filtering.
Premium adds Private Link origins, so the origin needs no public access at all. Otherwise lock origins to Front Door with the AzureFrontDoor.Backend service tag plus the X-Azure-FDID header check, or anyone can bypass your WAF.
Compare: Traffic Manager is DNS-based global routing (any protocol, no proxy); Application Gateway is a regional L7 proxy with WAF; Load Balancer is regional L4.
Example
resource profile 'Microsoft.Cdn/profiles@2024-09-01' = {
name: 'afd-orders', location: 'global', sku: { name: 'Premium_AzureFrontDoor' }
}
resource endpoint 'Microsoft.Cdn/profiles/afdEndpoints@2024-09-01' = { parent: profile, name: 'orders', location: 'global' }
resource web 'Microsoft.Cdn/profiles/originGroups@2024-09-01' = {
parent: profile, name: 'web'
properties: {
loadBalancingSettings: { sampleSize: 4, successfulSamplesRequired: 3, additionalLatencyInMilliseconds: 50 }
healthProbeSettings: { probePath: '/healthz', probeProtocol: 'Https', probeRequestType: 'GET', probeIntervalInSeconds: 30 }
}
}
// priority 1 = primary (West Europe), priority 2 = failover (North Europe)
resource origins 'Microsoft.Cdn/profiles/originGroups/origins@2024-09-01' = [for (app, i) in ['orders-weu', 'orders-neu']: {
parent: web, name: app
properties: { hostName: '${app}.azurewebsites.net', originHostHeader: '${app}.azurewebsites.net', priority: i + 1, weight: 1000 }
}]
resource route 'Microsoft.Cdn/profiles/afdEndpoints/routes@2024-09-01' = {
parent: endpoint, name: 'default', dependsOn: [origins]
properties: {
originGroup: { id: web.id }, patternsToMatch: ['/*'], supportedProtocols: ['Http', 'Https']
httpsRedirect: 'Enabled', forwardingProtocol: 'HttpsOnly', linkToDefaultDomain: 'Enabled'
}
}Remember
- Front Door = global anycast L7 proxy, CDN and WAF
- Origin groups with health probes and priorities give regional failover
- Premium adds Private Link origins
- Lock origins to Front Door or the WAF can be bypassed
Watch out for
- Leaving the App Service origin publicly reachable, so attackers skip Front Door's WAF entirely.