Azure Front Door Guide: Global Acceleration & WAF

What Is Azure Front Door

Azure Front Door is Microsoft's cloud CDN plus load balancer, delivering content over the Microsoft global network (118+ edge sites across 100+ metro areas). It accelerates both static and dynamic content and often serves as a global application entry point: it provides CDN caching as well as cross-region routing, health checks, and SSL offload. Compared with a plain CDN, it behaves more like an application-layer gateway, well suited to dynamic content acceleration scenarios.

Key Features

  • Anycast + Split TCP: connection establishment is optimized to the nearest edge, improving latency by up to three times.
  • Edge SSL offload: HTTPS terminates at the edge with automatically rotated managed certificates, reducing certificate management overhead.
  • Intelligent routing and health probes: traffic is routed to healthy origins based on their status for high availability.
  • Unified static and dynamic delivery: one tier provides caching, SSL offload, and L3-L4 DDoS protection.

Standard vs Premium

Capability Standard Premium
Global Anycast acceleration ✔ ✔
Rules Engine / caching ✔ ✔
Managed WAF rules Basic Full (incl. bot protection)
Private Link origins ✘ ✔
Azure security posture integration Basic Full

Most global sites are fine with Standard; move to Premium only if you need to hide origins inside a virtual network (Private Link) or want fuller bot protection.

Step 1: Create a Front Door

In the Azure portal, create a Front Door resource and choose Standard or Premium:

  1. Create a Front Door profile with a resource group and region.
  2. Create an Endpoint; it maps to a user-facing global domain.
  3. Add an Origin Group: add backends such as App Service, Storage, or VMs, and set the health probe interval and protocol so Front Door automatically removes unhealthy origins.

The same creation works from the Azure CLI (creating a profile here):

az afd profile create \
  --resource-group my-rg \
  --profile-name my-frontdoor \
  --sku Standard_AzureFrontDoor

CLI configuration fits naturally into IaC scripts and version control, avoiding manual mis-clicks in the portal.

Step 2: Configure Routes

Create a Route mapping a request path (such as /api/* or /*) to an origin group, and configure:

  • Protocol: HTTP/HTTPS; force HTTPS redirects for security.
  • Caching rules: set cache TTL for static content, or bypass caching for dynamic requests.
  • Rules Engine: rewrite paths, inject headers, or rewrite URLs at the edge using regex and server variables.

For multi-region origins, use cross-region failover, and pair it with multi-CDN load balancing for higher-level redundancy.

A Real Scenario: Global Acceleration for Cross-Border E-Commerce

An independent store serving North America and Southeast Asia kept its origin in Singapore. North American users connected directly to the origin, with first-paint TTFB averaging 600-900ms, and cross-ocean links dropped packets during promotions. After moving behind Front Door, static assets were cached at the edge, and dynamic APIs connected via Anycast to the nearest edge before going to the origin — North American first paint dropped to around 200ms. Just as importantly, health probes routed traffic around a failing origin: during one Singapore datacenter maintenance window, traffic silently shifted to a standby origin in Hong Kong with zero user-visible impact. For this kind of "global users + one or few origins" architecture, Front Door's acceleration and failover value is direct.

Step 3: Attach a Custom Domain and Certificate

  1. Add a custom domain such as www.example.com in Front Door and complete domain ownership validation.
  2. Use managed certificates: Azure creates and rotates them automatically, or upload your own.
  3. Add a CNAME record pointing to the Front Door endpoint domain.

For certificate types and procurement, see SSL certificate guide 2026.

Step 4: Attach a WAF Policy

Azure Front Door attaches seamlessly to a Web Application Firewall (WAF):

  • Built-in managed rule sets: SQL injection, XSS, malicious bots, and more out of the box.
  • Custom rules: allow or block by IP, geography, or request header.
  • Combine with Azure DDoS Protection for full L3-L7 defense; see CDN security protection features.

A WAF policy runs in two modes: detection mode only logs matches without blocking, while prevention mode actively blocks. Right after launch, run detection mode for about a week to confirm the rules don't break legitimate traffic (for example, mistakenly blocking valid mobile requests), then switch to prevention. The two most common custom rules are "rate-limit by IP" and "block traffic from specific countries or regions."

Pricing and When to Choose It

Front Door bills by endpoints, forwarding rules, data transfer, and requests, with no upfront commitment. It fits global multi-region apps, hybrid static/dynamic acceleration, and edge WAF with DDoS protection. If your business lives in the Azure ecosystem and you want routing and security delivered together, it beats a plain CDN. For a comparison, see our CDN provider selection guide.

Frequently Asked Questions

  • Can Front Door replace the origin's CDN? It can, but remember it is positioned as an application-layer gateway — for image-heavy sites with massive static assets, a classic CDN is usually cheaper and simpler.
  • What if route priorities conflict? Front Door matches routes by longest prefix. Put more specific paths (like /api/*) first so they aren't swallowed by a catch-all route.
  • How often should health probes run? 30-60 seconds is typical; more frequent probes add origin load, while rarer probes slow down failover.

16IDC Take

Front Door's value is combining "CDN + load balancer + WAF" in one: one configuration handles acceleration, failover, and security, ideal for global SaaS and cross-border e-commerce. The trade-offs are more billing meters and a steeper learning curve than a pure CDN. For small sites that only need image/static acceleration, a classic CDN is more cost-effective. More content in the CDN acceleration category.

Source: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview
Reference: Azure Front Door documentation https://learn.microsoft.com/en-us/azure/frontdoor/
Reference: Azure CLI afd reference https://learn.microsoft.com/en-us/cli/azure/afd