Global Load Balancing with Azure Front Door

What Azure Front Door does

Azure Front Door is a global entry point for your applications. It sits at Microsoft’s edge network, which spans 200+ edge locations (Points of Presence) worldwide. When a user makes a request, Front Door answers from the nearest edge location, then forwards the request to the optimal backend based on health and latency.

Front Door provides three core capabilities:

Global load balancing: Distribute traffic across backends in multiple Azure regions. If East US goes down, Front Door automatically routes to West US or West Europe.

CDN and caching: Cache static content at edge locations. Repeat requests for the same file are served from the edge without hitting your origin servers.

Security: WAF policies that block web attacks before they reach your application. DDoS protection at the edge.

Front Door tiers: Standard and Premium

Start with Standard unless you specifically need Private Link origins (to keep backend traffic off the public internet) or the enhanced security reports in Premium.

Core concepts

Endpoint: The public URL that clients connect to. Front Door provides a URL like myapp.azurefd.net, and you can map a custom domain to it.

Origin group: A set of backend servers. Front Door load balances across origins within the group. An origin can be an Azure App Service, Application Gateway, Storage account, or any public IP/FQDN.

Route: Maps a URL path pattern on the endpoint to an origin group. You can have different routes send different URL patterns to different origin groups.

Health probe: Front Door sends periodic probes to each origin. Unhealthy origins are removed from the rotation until they recover.

Caching rule: Controls whether Front Door caches responses for a given route and for how long.

Creating Front Door with the CLI

Create a Front Door Standard profile with a web app backend:

# Create the Front Door profile
az afd profile create \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --sku Standard_AzureFrontDoor

# Create an endpoint
az afd endpoint create \
  --endpoint-name ep-myapp \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking

# Create an origin group
az afd origin-group create \
  --origin-group-name og-webapp \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --probe-request-type GET \
  --probe-protocol Https \
  --probe-interval-in-seconds 30 \
  --sample-size 4 \
  --successful-samples-required 3 \
  --additional-latency-in-milliseconds 50

Add two backends in different regions to the origin group:

# East US backend (App Service)
az afd origin create \
  --origin-name origin-eastus \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --origin-group-name og-webapp \
  --host-name myapp-eastus.azurewebsites.net \
  --origin-host-header myapp-eastus.azurewebsites.net \
  --http-port 80 \
  --https-port 443 \
  --priority 1 \
  --weight 1000 \
  --enabled-state Enabled

# West Europe backend (App Service)
az afd origin create \
  --origin-name origin-westeu \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --origin-group-name og-webapp \
  --host-name myapp-westeu.azurewebsites.net \
  --origin-host-header myapp-westeu.azurewebsites.net \
  --http-port 80 \
  --https-port 443 \
  --priority 1 \
  --weight 1000 \
  --enabled-state Enabled

# Create a route connecting the endpoint to the origin group
az afd route create \
  --route-name route-main \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --endpoint-name ep-myapp \
  --origin-group og-webapp \
  --supported-protocols Https \
  --https-redirect Enabled \
  --forwarding-protocol HttpsOnly \
  --link-to-default-domain Enabled

Routing methods: latency vs weighted

Front Door supports different origin selection methods. The default is latency-based: Front Door sends the request to the origin with the lowest measured latency from the edge that received the request. This naturally routes users to the closest region.

Weighted routing lets you split traffic by percentage — useful for canary deployments or gradual traffic shifts. Set the weight parameter when creating origins: higher weight means more traffic.

Priority routing lets you designate primary and standby origins. All traffic goes to priority 1 origins. If all priority 1 origins are unhealthy, traffic fails over to priority 2 origins. This is useful for active-passive disaster recovery.

Custom domains and HTTPS

Front Door provides free managed TLS certificates for custom domains. Azure handles certificate provisioning, renewal, and rotation automatically.

# Add a custom domain to the Front Door profile
az afd custom-domain create \
  --custom-domain-name cd-myapp \
  --profile-name afd-prod-global \
  --resource-group rg-prod-networking \
  --host-name www.example.com \
  --minimum-tls-version TLS12 \
  --certificate-type ManagedCertificate