Azure Front Door

What is Azure Front Door?

Azure Front Door is a global, scalable entry point for web applications. It uses Microsoft's global anycast network — with over 100 edge locations worldwide — to bring your application close to users everywhere. Key capabilities:

• Global HTTP/HTTPS load balancing — Route to the best backend globally
• CDN caching — Cache content at edge locations near users
• SSL offloading — Terminate SSL/TLS at the edge
• WAF — Protect against web attacks at the global edge
• URL routing — Path and hostname-based routing
• Instant failover — Automatically routes around failed backends

Front Door Tiers

How Front Door Works

When a user requests your website:

1. DNS resolves your domain to a Front Door anycast IP
2. The request is routed to the nearest Front Door edge PoP
3. Front Door checks if the response is cached — if so, returns it immediately
4. If not cached, Front Door selects the best backend (lowest latency, healthiest) and proxies the request
5. The response is cached at the edge for future requests
6. Front Door returns the response to the user

Because Front Door terminates the connection at the edge (near the user) and maintains a persistent warm connection to the backend, round-trip latency for users worldwide is dramatically reduced.

Routing Methods

Front Door can route traffic across origins (backends) using different methods:

CDN Caching

Front Door caches static content (images, CSS, JS, HTML) at edge locations. Subsequent requests for the same content are served from the cache — no round-trip to your origin needed.

Caching Rules

• Configure cache duration per route
• Cache based on query strings
• Purge specific paths or all cached content when needed

Cache Hit Ratio

Monitor your cache hit ratio in Front Door metrics. A high cache hit ratio (80%+) means most requests are served from cache — reducing origin load and improving latency.

WAF Integration

Front Door Premium includes a Web Application Firewall at the global edge — protecting all your origins simultaneously. The WAF runs at the edge before traffic reaches your backends — blocking attacks without them ever reaching your servers.

WAF Policy

A WAF policy defines managed rule sets (OWASP) and custom rules. The same WAF policy can be shared across multiple Front Door endpoints — centralised security management.

Health Probes and Failover

Front Door continuously probes origin health. When an origin fails health checks:

1. Front Door detects the failure within ~30 seconds
2. Stops routing new requests to the failed origin
3. Continues routing to healthy origins
4. Automatically resumes routing to the origin when it recovers

This gives you automatic multi-region failover — if your primary region goes down, Front Door routes to your secondary region automatically, with near-zero downtime for users.

Custom Domains and HTTPS

Front Door provides free managed SSL certificates for custom domains. Setup:

1. Add your custom domain to Front Door
2. Create a CNAME in your DNS: www.contoso.com → contoso.azurefd.net
3. Enable HTTPS — Front Door provisions a managed certificate automatically
4. Front Door renews the certificate before expiry

Front Door vs Traffic Manager vs App Gateway