Azure Front DoorAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• One address for the worldVisitors connect to the closest point on Microsoft’s network over anycast, and Front Door carries the request to your origin over that private network. That shortens the slow first hop and usually cuts latency to far-away origins.
• Routing by domain and pathA route matches a domain and a path pattern and hands the request to an origin group, so /api/ and / can go to different back ends behind the same host name.
• Health probes and failoverFront Door probes every origin from its edge locations and stops sending traffic to an origin that fails. Origins within a group can be balanced by latency, weight or priority.
• Caching and compressionCaching is a setting on the route. Front Door obeys the origin’s cache headers or a rule’s override, can compress text responses, and lets you purge paths.
• Rule setsConditions on the request (path, header, scheme, country) trigger actions such as a redirect, a URL rewrite, a response header or a different origin group, with no code to run.
• Web application firewallA WAF policy attached to the profile blocks common attacks and abusive clients. Standard supports custom rules, including rate limits. Premium adds Microsoft-managed rule sets and bot protection.
• Private Link originsOn Premium, Front Door can reach an App Service, a storage account or an internal load balancer through a private endpoint, so the origin needs no public address.
• Managed certificatesFor a custom domain Front Door can issue and renew the certificate, once the DNS records prove you own the name. You can also bring a certificate from Key Vault.

Profile

The top-level Front Door resource. Its tier (Standard or Premium) is chosen at creation, and it holds the endpoints, origin groups, rule sets, security policies and domains.

Endpoint

A named entry point with a host name under azurefd.net. Routes belong to an endpoint, and custom domains are associated with its routes.

Origin and origin group

An origin is a back end that Front Door fetches from. An origin group collects origins that serve the same content, with probe and load balancing settings.

Route

Maps domains and path patterns on an endpoint to an origin group, and sets the accepted protocols, the HTTPS redirect, the forwarding protocol, caching and compression.

Health probe

A small request that each edge location sends to every origin to decide whether it should get traffic. Probe settings sit on the origin group.

Rule set

An ordered list of rules, each with conditions and actions. A route lists the rule sets it uses.

Security policy

Connects a WAF policy to domains and path patterns in the profile.

Origin host header

The host name that Front Door puts in the request to the origin. Many hosted services answer only to their own name, so this must match.

Front Door ID (X-Azure-FDID)

A header that Front Door adds with the ID of your profile, which an origin can check to accept only traffic that came through your profile.

Service tag AzureFrontDoor.Backend

The set of IP addresses that Front Door uses to reach origins, which firewalls and network security groups can allow.

Purge

A request to remove cached content from the edge before its time is up. A path ending with /* removes everything below it.

Anycast and split TCP

Visitors connect to the nearest edge location, and Front Door keeps long-lived connections to origins, which removes much of the connection set-up cost from each request.

Classic and Standard/Premium

The older Front Door (classic) and Azure CDN products are on a retirement path. Standard and Premium are the current tiers and replace both.

Put a web app behind Front Door with the Azure CLI

1. Choose the tierPick Standard for global routing, caching and custom WAF rules. Pick Premium if you need managed WAF rule sets, bot protection or Private Link to origins.
2. Create the profile and an endpointThe endpoint gives you a working azurefd.net name straight away, before any custom domain is set up.
3. Define an origin group with health probesProbe a light path such as /health with HEAD and a sensible interval, because every edge location probes every origin.
4. Add the origin with the right host headerSet the origin host header to the name that the app answers to. A mismatch is the most common source of 404 errors.
5. Create the routeSend /* to the origin group, redirect HTTP to HTTPS, forward over HTTPS only and turn on compression and caching with a query string rule.
6. Add rules where they helpUse a rule set for security headers, redirects and path rewrites instead of changing the application.
7. Add your domain and a WAF policyCreate a custom domain with DNS validation, then attach a WAF policy through a security policy.
8. Lock the origin to Front DoorAllow only the AzureFrontDoor.Backend service tag and check the X-Azure-FDID header, or use Private Link on Premium.
9. Test the cache and watch the metricsRequest a file twice and read X-Cache. Alarm on origin health, 5xx percentage and the byte hit ratio.

• Enable caching on routes for static and cacheable content, and use long cache durations with versioned file names.
• Turn on compression for text formats, so responses are a fraction of the size.
• Ignore query strings that don’t change the response, so tracking parameters don’t split the cache.
• Place the origin in a region near most users, and add a second origin group in another region for failover.
• Probe with HEAD and a longer interval, so the origins aren’t busy answering probes.
• Use latency-based routing between origins in different regions, with a small extra-latency allowance.
• Keep origin responses cacheable by sending correct Cache-Control headers.
• Use rule sets for redirects at the edge, instead of sending those requests to the origin.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Azure Front Door.

• Start on Standard and move to Premium only for managed WAF rules, bot protection or Private Link.
• Raise the cache hit ratio, because data served from the cache doesn’t go back to the origin.
• Compress text responses, and size images, since data transfer is billed per GB.
• Consolidate profiles: each one carries its own monthly base fee.
• Reduce probe traffic with HEAD and a longer interval.
• Remove unused endpoints, routes and custom domains.
• Serve large static downloads through a route with caching, so they aren’t fetched from the origin each time.
• Check requests to the origin by response code, and fix the 4xx and 5xx that add cost without value.
• Compare Front Door with running your own regional entry points, including the staff time.
• Tag profiles by team and add a budget alert on the resource group.

• Attach a WAF policy to the profile, start in detection mode to learn, then switch to prevention.
• Add rate-limit custom rules to slow down abusive clients on login and API paths.
• Make the origin private: Private Link on Premium, or the AzureFrontDoor.Backend tag plus a check of X-Azure-FDID.
• Use HTTPS only, redirect HTTP and set a minimum TLS version on custom domains.
• Use managed certificates or Key Vault certificates, and watch their state.
• Add security headers (HSTS and others) with a rule set.
• Send diagnostic and WAF logs to Log Analytics, and alert on blocked-request spikes.
• Limit who can change routes, rules and WAF policies with Azure RBAC, and add resource locks to profiles.
• Review the Default Rule Set and Bot Manager updates on Premium, and test them before enforcing.
• Keep secrets out of rules and headers, and use managed identities and Key Vault references.

Azure Policy audits and enforces settings, Microsoft Defender for Cloud reports posture, the activity log and Azure Monitor record changes and metrics, and the Microsoft Service Trust Portal holds compliance reports. Microsoft runs the edge network. The routing design, WAF rules, certificates, origin lock-down and what is cached are yours.

• Caching more at the edge means fewer requests reach the origin.
• Turn on compression for text types, and keep image files close to their display size.
• Probe less often and consolidate unused endpoints and profiles.
• Serve users from the nearest origin region to shorten network paths.
• Origins can run in a region with a cleaner power grid, as long as data rules and latency allow it.
• Microsoft’s Emissions Impact Dashboard reports per subscription, with no separate figure for Front Door, so this page gives none.

Purchase options

What you actually pay for

• A monthly base fee for every profile, by tier
• Outbound data transfer from the edge, to visitors and to origins
• Incoming requests
• WAF extras such as CAPTCHA, and custom rules above any included count
• Origin-side costs, including the health-probe traffic your origins serve

A web app behind Front Door Standard: a profile and endpoint, an origin group with a light health probe, an origin with the right host header, a rule set that adds a security header, a route that redirects to HTTPS and caches, and a purge. The CLI tab builds it; Terraform describes the same resources and adds a WAF policy with a rate-limit rule. The Python tab purges paths and reports whether a URL is served from the cache; the C# tab audits profiles for routes that allow HTTP, profiles without a WAF and classic SKUs. Replace the names and the origin host with your own.

# Placeholders: replace the names and the origin host with your own. Front Door is global, but the resource group still needs a location.
RG=rg-afd-demo
PROFILE=afd-shop
ENDPOINT=shop-$RANDOM
ORIGIN_HOST=myshop-web.azurewebsites.net

az group create --name $RG --location centralindia

# 1. A Standard profile and an endpoint. The endpoint gets a working host name under azurefd.net straight away.
az afd profile create --resource-group $RG --profile-name $PROFILE --sku Standard_AzureFrontDoor
az afd endpoint create --resource-group $RG --profile-name $PROFILE --endpoint-name $ENDPOINT --enabled-state Enabled

# 2. An origin group with a light probe (HEAD, once a minute), and the origin itself.
#    Every edge location probes every origin, so keep the probe cheap. The origin host header must be the name the app answers to.
az afd origin-group create --resource-group $RG --profile-name $PROFILE --origin-group-name web \
  --probe-request-type HEAD --probe-protocol Https --probe-path /health --probe-interval-in-seconds 60 \
  --sample-size 4 --successful-samples-required 3 --additional-latency-in-milliseconds 50
az afd origin create --resource-group $RG --profile-name $PROFILE --origin-group-name web --origin-name app-1 \
  --host-name $ORIGIN_HOST --origin-host-header $ORIGIN_HOST --http-port 80 --https-port 443 --priority 1 --weight 1000 --enabled-state Enabled

# 3. A rule set that adds a security header to every response.
az afd rule-set create --resource-group $RG --profile-name $PROFILE --rule-set-name security
az afd rule create --resource-group $RG --profile-name $PROFILE --rule-set-name security --rule-name nosniff --order 1 \
  --action-name ModifyResponseHeader --header-action Overwrite --header-name X-Content-Type-Options --header-value nosniff

# 4. The route: every path goes to the origin group, HTTP is redirected to HTTPS, the origin is called over HTTPS only,
#    and responses are compressed and cached, with query strings left out of the cache key.
az afd route create --resource-group $RG --profile-name $PROFILE --endpoint-name $ENDPOINT --route-name default \
  --origin-group web --supported-protocols Http Https --https-redirect Enabled --forwarding-protocol HttpsOnly \
  --link-to-default-domain Enabled --patterns-to-match "/*" --rule-sets security \
  --enable-compression true --query-string-caching-behavior IgnoreQueryString

# 5. Request a page twice. X-Cache says TCP_MISS for the first answer and TCP_HIT for a cached one, and X-Azure-Ref
#    is the reference to quote to Microsoft support.
HOST=$(az afd endpoint show --resource-group $RG --profile-name $PROFILE --endpoint-name $ENDPOINT --query hostName --output tsv)
curl -sI https://$HOST/ | grep -i -E "^(HTTP|x-cache|x-azure-ref)"
curl -sI https://$HOST/ | grep -i -E "^(HTTP|x-cache|x-azure-ref)"

# 6. After a release, purge the changed paths from the edge.
az afd endpoint purge --resource-group $RG --profile-name $PROFILE --endpoint-name $ENDPOINT --domains $HOST \
  --content-paths "/index.html" "/assets/*"

# 7. Is the origin healthy, and how much was served from the cache? Both are metrics on the profile.
PROFILE_ID=$(az afd profile show --resource-group $RG --profile-name $PROFILE --query id --output tsv)
az monitor metrics list --resource $PROFILE_ID --metric OriginHealthPercentage --aggregation Average --interval PT5M --offset 1h
az monitor metrics list --resource $PROFILE_ID --metric ByteHitRatio --aggregation Average --interval PT1H --offset 1d

# Placeholders: pass in your own names. The values below are examples.
variable "origin_host" {
  type    = string
  default = "myshop-web.azurewebsites.net"
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "afd" {
  name     = "rg-afd-demo"
  location = "centralindia"
}

resource "azurerm_cdn_frontdoor_profile" "shop" {
  name                = "afd-shop"
  resource_group_name = azurerm_resource_group.afd.name
  sku_name            = "Standard_AzureFrontDoor"
}

resource "azurerm_cdn_frontdoor_endpoint" "shop" {
  name                     = "shop-endpoint"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.shop.id
}

resource "azurerm_cdn_frontdoor_origin_group" "web" {
  name                     = "web"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.shop.id

  load_balancing {
    sample_size                        = 4
    successful_samples_required        = 3
    additional_latency_in_milliseconds = 50
  }

  health_probe {
    protocol            = "Https"
    request_type        = "HEAD"
    path                = "/health"
    interval_in_seconds = 60
  }
}

resource "azurerm_cdn_frontdoor_origin" "app" {
  name                           = "app-1"
  cdn_frontdoor_origin_group_id  = azurerm_cdn_frontdoor_origin_group.web.id
  enabled                        = true
  host_name                      = var.origin_host
  origin_host_header             = var.origin_host
  http_port                      = 80
  https_port                     = 443
  priority                       = 1
  weight                         = 1000
  certificate_name_check_enabled = true
}

resource "azurerm_cdn_frontdoor_route" "default" {
  name                          = "default"
  cdn_frontdoor_endpoint_id     = azurerm_cdn_frontdoor_endpoint.shop.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.web.id
  cdn_frontdoor_origin_ids      = [azurerm_cdn_frontdoor_origin.app.id]
  patterns_to_match             = ["/*"]
  supported_protocols           = ["Http", "Https"]
  https_redirect_enabled        = true
  forwarding_protocol           = "HttpsOnly"
  link_to_default_domain        = true

  cache {
    query_string_caching_behavior = "IgnoreQueryString"
    compression_enabled           = true
    content_types_to_compress     = ["text/html", "text/css", "application/javascript", "application/json", "image/svg+xml"]
  }
}

# Standard supports custom WAF rules. This one slows a client that sends more than 100 requests a minute.
resource "azurerm_cdn_frontdoor_firewall_policy" "shop" {
  name                = "shopwaf"
  resource_group_name = azurerm_resource_group.afd.name
  sku_name            = azurerm_cdn_frontdoor_profile.shop.sku_name
  enabled             = true
  mode                = "Prevention"

  custom_rule {
    name                           = "RateLimit"
    enabled                        = true
    priority                       = 100
    type                           = "RateLimitRule"
    action                         = "Block"
    rate_limit_duration_in_minutes = 1
    rate_limit_threshold           = 100

    match_condition {
      match_variable     = "RequestUri"
      operator           = "Contains"
      match_values       = ["/"]
      negation_condition = false
    }
  }
}

resource "azurerm_cdn_frontdoor_security_policy" "shop" {
  name                     = "shop-security"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.shop.id

  security_policies {
    firewall {
      cdn_frontdoor_firewall_policy_id = azurerm_cdn_frontdoor_firewall_policy.shop.id

      association {
        patterns_to_match = ["/*"]

        domain {
          cdn_frontdoor_domain_id = azurerm_cdn_frontdoor_endpoint.shop.id
        }
      }
    }
  }
}

output "endpoint_host_name" {
  value = azurerm_cdn_frontdoor_endpoint.shop.host_name
}

# pip install azure-mgmt-cdn azure-identity
# Purges paths from a Front Door endpoint, and reports whether a URL is being served from the edge cache.
import os
import urllib.request

from azure.identity import DefaultAzureCredential
from azure.mgmt.cdn import CdnManagementClient
from azure.mgmt.cdn.models import AfdPurgeParameters

cdn = CdnManagementClient(DefaultAzureCredential(), os.environ["AZURE_SUBSCRIPTION_ID"])


def purge(resource_group, profile, endpoint, paths, domains):
    """Starts a purge and waits for it to finish. A path ending in /* removes everything below it.
    Purging is for exceptions: version your file names so that a release doesn't need it."""
    poller = cdn.afd_endpoints.begin_purge_content(resource_group, profile, endpoint, AfdPurgeParameters(content_paths=paths, domains=domains))
    poller.result()


def cache_report(url, requests=2):
    """Requests the URL a few times and prints what the edge says. X-Cache is TCP_HIT when the answer came from the cache and
    TCP_MISS when it came from the origin. Quote X-Azure-Ref to Microsoft support: it identifies the request."""
    rows = []
    for attempt in range(1, requests + 1):
        with urllib.request.urlopen(url) as reply:
            headers = reply.headers
            rows.append((attempt, reply.status, headers.get("X-Cache"), headers.get("Age"), headers.get("X-Azure-Ref")))
            print("%d: HTTP %d  x-cache=%s  age=%s  x-azure-ref=%s" % rows[-1])
    return rows


if __name__ == "__main__":
    host = os.environ["FRONT_DOOR_HOST"]  # for example shop-abc123.z01.azurefd.net
    cache_report("https://%s/" % host)
    purge("rg-afd-demo", "afd-shop", "shop-endpoint", ["/index.html", "/assets/*"], [host])

// dotnet add package Azure.ResourceManager.Cdn
// dotnet add package Azure.Identity
// Audits every Front Door profile in the subscription: routes that accept HTTP without redirecting to HTTPS, profiles with no security policy (WAF) and classic SKUs.
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Cdn;
using Azure.ResourceManager.Resources;

var arm = new ArmClient(new DefaultAzureCredential());
SubscriptionResource subscription = await arm.GetDefaultSubscriptionAsync();
int problems = 0;

await foreach (ProfileResource profile in subscription.GetProfilesAsync())
{
    string sku = profile.Data.SkuName?.ToString() ?? "";
    if (!sku.Contains("AzureFrontDoor"))
    {
        Console.WriteLine($"{profile.Data.Name}: SKU {sku} is a classic Azure CDN product, which is on a retirement schedule");
        problems++;
        continue;
    }

    int policies = 0;
    await foreach (FrontDoorSecurityPolicyResource _ in profile.GetFrontDoorSecurityPolicies()) policies++;
    if (policies == 0)
    {
        Console.WriteLine($"{profile.Data.Name}: no security policy, so no WAF in front of the origins");
        problems++;
    }

    await foreach (FrontDoorEndpointResource endpoint in profile.GetFrontDoorEndpoints())
    {
        await foreach (FrontDoorRouteResource route in endpoint.GetFrontDoorRoutes())
        {
            bool allowsHttp = route.Data.SupportedProtocols.Any(p => p.ToString() == "Http");
            bool redirects = route.Data.HttpsRedirect.ToString() == "Enabled";
            if (allowsHttp && !redirects)
            {
                Console.WriteLine($"{profile.Data.Name}/{endpoint.Data.Name}/{route.Data.Name}: accepts HTTP and does not redirect to HTTPS");
                problems++;
            }
        }
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical origins are Azure App Service, Azure Blob Storage and Azure API Management. Certificates can come from Azure Key Vault, and logs and metrics go to Azure Monitor.