Azure Front Door: Global Delivery

Azure Front Door is a global Layer 7 load balancer with CDN, WAF, and acceleration built in. It uses Microsoft’s global edge network (200+ PoPs) to deliver content with the lowest latency.

Simple explanation

Front Door is your global receptionist — users worldwide connect to the nearest edge location (118+ globally), and Front Door routes their request to the best backend using Microsoft’s private backbone. It combines global load balancing, CDN caching, and WAF in one service.

Front Door Tiers

Front Door Standard vs Premium
Feature	Standard	Premium
CDN / Caching	Yes	Yes
Custom domains + TLS	Yes	Yes
WAF — Custom rules	Yes	Yes
WAF — Managed rules (DRS)	No	Yes
WAF — Bot protection	No	Yes
Private Link origins	No	Yes — connect to origins without public IPs
Enhanced analytics	Basic reports	Advanced analytics + WAF logs
Origin health probes	Yes	Yes
Rules engine	Yes	Yes
DDoS protection	Built-in	Built-in + enhanced

Exam Tip: The two Premium-only features the exam loves to test: managed WAF rules (DRS) and Private Link origins. If a question mentions connecting to a backend without a public IP through Front Door, the answer is Premium with Private Link.

Front Door Components

Component	Purpose
Endpoint	The Front Door hostname clients connect to (e.g., myapp.azurefd.net or custom domain)
Route	Maps incoming URL patterns to an origin group. Includes protocol, caching, and rule set configuration.
Origin group	A set of origins that serve the same content. Load balancing and health probes are configured here.
Origin	The actual backend — App Service, Storage, VM public IP, custom hostname. Each origin has a priority and weight.
Rule set	Rules engine for modifying requests/responses (redirects, header rewrites, URL rewrites).

Traffic flow:

Client → Edge PoP → Endpoint → Route (matches URL pattern)
  → Origin Group (selects healthiest/fastest origin)
    → Origin (your backend server)

Caching and Acceleration

Front Door provides CDN capabilities built in:

Caching: Static content is cached at edge PoPs. Configure caching per route — cache based on query string, headers, or full URL.
Connection pooling: Front Door maintains persistent connections to origins, reducing latency.
Split TCP: Client connects to the nearest edge PoP (fast). Edge PoP connects to origin over optimised Microsoft backbone (fast). This dramatically reduces cold-start latency.

Private Link Origins (Premium Only)

☁️ Elena’s scenario: Skyline Logistics wants to use Front Door for global delivery but doesn’t want their origin servers to have public IP addresses.

With Private Link origins:

Front Door Premium connects to the origin through a private endpoint
The origin doesn’t need a public IP — no internet exposure
Supported origins: App Service, Storage, Internal Load Balancer, any Private Link service

This is powerful for security — your backend is completely private, and Front Door is the only entry point.

Rules Engine — Customising Traffic

The rules engine lets you modify requests and responses as they pass through Front Door:

Common rules:

URL redirect: HTTP to HTTPS, www to non-www
URL rewrite: Change the URL path before forwarding to origin (e.g., /v2/api/* to /api/*)
Header modification: Add, remove, or overwrite request/response headers
Cache override: Force caching or bypass for specific paths
Route override: Send matching traffic to a different origin group

Conditions you can match:

URL path, query string, HTTP method
Request headers (Host, User-Agent, custom)
Client IP address, geo-location
Protocol (HTTP/HTTPS)

Rules are processed in order within a rule set. Multiple rule sets can be associated with a route.

Front Door vs Application Gateway

Feature	Application Gateway	Azure Front Door
Scope	Regional	Global (200+ edge PoPs)
CDN/Caching	No	Yes — built-in
WAF	Yes (regional)	Yes (global edge)
Private Link origins	No	Yes (Premium)
Layer	Layer 7 (HTTP/HTTPS)	Layer 7 (HTTP/HTTPS)
Path routing	Yes	Yes
TLS termination	Yes	Yes
WebSocket	Yes	Yes
Best for	Regional web apps, internal apps	Global web apps, CDN, global WAF
Common pattern	Backend for Front Door	Frontend global entry point

Common combination: Front Door (global entry) → Application Gateway (regional, with WAF) → Backend VMs. Front Door handles global distribution and caching, AG handles regional routing and additional WAF rules.

Key Takeaways

Front Door is global Layer 7; Application Gateway is regional Layer 7
Premium adds managed WAF rules, bot protection, and Private Link origins
CDN caching and split TCP acceleration are built in
Private Link origins keep backends completely private
Front Door + Application Gateway is a common enterprise pattern

Test Your Knowledge

Question

What are the two key Premium-only features in Front Door?

Click or press Enter to reveal answer

Answer

1. Managed WAF rules (Default Rule Set / DRS) and bot protection. 2. Private Link origins — connect to backends without public IPs through a private endpoint.

Click to flip back

Question

How does Front Door reduce latency with split TCP?

Click or press Enter to reveal answer

Answer

Client connects to the nearest edge PoP (short, fast connection). The PoP connects to the origin over Microsoft's optimised backbone (persistent, fast connection). The client doesn't need to traverse the full path to the origin.

Click to flip back

Question

What is a Private Link origin?

Click or press Enter to reveal answer

Answer

A Front Door Premium feature that connects to backend origins through a private endpoint. The origin doesn't need a public IP — Front Door is the only entry point. Supported for App Service, Storage, Internal LB, and Private Link services.

Click to flip back

Knowledge Check

Elena needs global CDN with WAF managed rules and backend servers that have no public IPs. Which Front Door tier does she need?

Knowledge Check

What is the typical enterprise pattern for using Front Door with Application Gateway?

Next up: Choosing the Right Load Balancer — The decision guide for picking between LB, Traffic Manager, Application Gateway, and Front Door.