Choosing the Right Load Balancer
The definitive decision guide for Azure's four load balancers — Load Balancer, Traffic Manager, Application Gateway, and Front Door. Master the exam elimination technique.
Choosing the Right Load Balancer
This is the module that ties Domain 3 together. The exam frequently presents a scenario and asks you to choose the right load balancer. This decision matrix and elimination technique will serve you well.
Azure has four load balancers: Load Balancer (traffic light — fast, simple, any vehicle), Traffic Manager (GPS — tells you which road, doesn’t drive), Application Gateway (smart toll booth — inspects tickets, routes to right lane), Front Door (international airport hub — global, caches, security screening).
The Four-Way Comparison
| Feature | Load Balancer | Traffic Manager | App Gateway | Front Door |
|---|---|---|---|---|
| Layer | Layer 4 (TCP/UDP) | DNS | Layer 7 (HTTP/S) | Layer 7 (HTTP/S) |
| Scope | Regional (cross-region with global tier) | Global | Regional | Global |
| Proxies traffic | Yes (pass-through) | No (DNS redirect only) | Yes (full proxy) | Yes (full proxy) |
| URL/path routing | No | No | Yes | Yes |
| TLS termination | No | No | Yes | Yes |
| WAF | No | No | Yes (add-on) | Yes (built-in) |
| CDN / Caching | No | No | No | Yes |
| Private Link origins | No | No | No | Yes (Premium) |
| Non-HTTP traffic | Yes (any TCP/UDP) | Yes (DNS — any protocol) | No | No |
| Session affinity | Source IP (2/3-tuple) | No | Cookie-based | Cookie-based |
| Health probes | TCP, HTTP, HTTPS | HTTP, HTTPS, TCP | HTTP, HTTPS | HTTP, HTTPS |
Decision Flowchart
Use this flowchart when the exam presents a load balancing scenario:
Step 1: Is the traffic HTTP/HTTPS?
- No → Load Balancer (for TCP/UDP) or Traffic Manager (for DNS-based routing of any protocol)
- Yes → Continue to Step 2
Step 2: Does it need global distribution?
- No (single region) → Application Gateway
- Yes (multi-region) → Continue to Step 3
Step 3: Does it need CDN, caching, or Private Link origins?
- Yes → Front Door (Premium if Private Link needed)
- No → Traffic Manager (if DNS-only is acceptable) or Front Door (if you need proxy/WAF)
Common Combinations
Load balancers work together, not in isolation:
Front Door + Application Gateway: Front Door handles global distribution, CDN, and edge WAF. Application Gateway handles regional routing, path-based rules, and additional WAF. This is the most common enterprise web app pattern.
Traffic Manager + Load Balancer: Traffic Manager provides global DNS routing to regional Load Balancers. Used for non-HTTP workloads (databases, gaming, IoT) that need global failover.
Front Door + Load Balancer: Front Door handles global HTTP entry. Load Balancer distributes within a region to non-HTTP backend tiers (e.g., TCP-based microservices behind an API layer).
Exam Elimination Guide
When you see a load balancing question, eliminate options using these rules:
“Non-HTTP protocol” mentioned → Eliminate Application Gateway and Front Door. Answer is Load Balancer or Traffic Manager.
“URL routing” or “path-based routing” needed → Eliminate Load Balancer and Traffic Manager. Answer is Application Gateway or Front Door.
“Global CDN” or “caching at edge” → Only Front Door provides this. Eliminate all others.
“Private Link origin” or “backend with no public IP” → Only Front Door Premium. Eliminate all others.
“DNS-based only” or “no proxy needed” → Traffic Manager. It’s the only one that doesn’t proxy traffic.
“Regional, internal workload” → Internal Load Balancer or Application Gateway (internal frontend).
“Session affinity with cookies” → Application Gateway or Front Door. Load Balancer uses source IP only.
“Layer 4, high throughput, HA ports” → Standard Load Balancer with HA ports.
Practice this elimination technique with every load balancing question you encounter.
Key Takeaways
- Non-HTTP traffic: Load Balancer (L4) or Traffic Manager (DNS)
- Regional HTTP: Application Gateway
- Global HTTP with CDN/WAF: Front Door
- Private Link origins: Front Door Premium only
- DNS-only (no proxy): Traffic Manager only
- Combinations are common in enterprise architectures
Test Your Knowledge
Ravi needs to load-balance a TCP-based database replication protocol across VMs in a single region. Which service should he use?
Elena needs global HTTP load balancing with CDN caching, managed WAF rules, and origins that have no public IPs. Which service and tier?
Next up: Private Link and Private Endpoints — Start Domain 4 by making Azure PaaS services accessible only through your private network.