Azure Front Door Standard and Premium Explained: CDN, WAF, Origins, Caching and Private Link

Last reviewed: August 2026

Azure Front Door is Microsoft's global Layer 7 application delivery and cloud CDN service. It uses Microsoft's global edge network to accelerate web applications and APIs, route requests to healthy origins, cache static content close to users, and protect internet-facing applications with Web Application Firewall capabilities.

Important: Azure Front Door (Classic) retires on March 31, 2027. New deployments should use Azure Front Door Standard or Azure Front Door Premium.

What Azure Front Door does#

• Global HTTP/HTTPS routing
• Dynamic site acceleration
• CDN caching for static content
• Health probes and origin failover
• Path-based routing
• Custom domains and TLS
• Web Application Firewall integration
• Rules engine for request/response behavior
• Origin protection
• Private Link to supported origins with Premium

Standard vs Premium#

Core components#

Profile#

The Front Door profile is the top-level resource for Standard/Premium.

Endpoint#

An endpoint provides the Front Door hostname that receives client traffic.

Origin#

An origin is a backend target such as App Service, API Management, Storage, Application Gateway, a public IP/FQDN or another supported service.

Origin group#

An origin group contains one or more origins and controls health probing, failover and load distribution between them.

Route#

A route connects an endpoint and domain to an origin group. Routes can match URL patterns, redirect HTTP to HTTPS, enable caching, and apply rule sets.

Typical architecture#

Health probes and failover#

Front Door probes origins and routes traffic only to origins considered healthy. Origin groups can contain multiple backends so traffic can fail over when a regional application becomes unavailable.

Caching#

Front Door can cache static assets such as images, JavaScript and CSS at edge locations. Configure caching intentionally and respect origin cache-control behavior. Do not cache user-specific or sensitive responses unless you fully understand the privacy and correctness implications.

Web Application Firewall#

WAF policies protect public web applications against common application-layer attacks. Premium provides broader managed-rule and security capabilities. WAF should be combined with strong origin security rather than treated as the only control.

Private Link with Front Door Premium#

Front Door Premium can connect privately to supported Azure origins using Azure Private Link. This reduces direct public exposure of the origin and helps ensure traffic reaches the backend through controlled private connectivity.

Custom domains and HTTPS#

Attach a custom domain to the Front Door endpoint and configure HTTPS using a supported managed certificate or your own certificate according to the tier and current certificate requirements. Verify domain ownership and DNS before enabling production traffic.

Create Azure Front Door Standard/Premium in the portal#

1. Open Azure portal → Front Door and CDN profiles → Create.
2. Select Front Door Standard or Premium.
3. Create the Front Door profile.
4. Create an endpoint.
5. Create an origin group.
6. Add one or more origins.
7. Configure health probes.
8. Create a route and associate URL patterns.
9. Enable HTTPS redirection if needed.
10. Enable caching for appropriate content.
11. Associate a WAF policy where required.
12. Add a custom domain and validate DNS.
13. For Premium, enable Private Link for supported origins where appropriate.

Azure CLI example#

Front Door Standard/Premium resources use the Microsoft.Cdn resource model. A typical automation flow creates the profile, endpoint, origin group, origin and route.

Then add the origin group, origin and route for your specific backend design.

Front Door vs Application Gateway vs Traffic Manager#

Front Door Classic migration#

Front Door Classic retires on March 31, 2027. Existing Classic deployments should be migrated to Standard or Premium before the retirement date. Standard/Premium use the newer Microsoft.Cdn resource provider model.

Common troubleshooting#

• Origin unhealthy: verify health probe path, protocol, host header, firewall and backend response.
• 404 from origin: check route patterns, origin host header and backend custom-domain configuration.
• Cached content is stale: inspect cache-control headers, route caching settings and purge requirements.
• WAF blocking valid traffic: review WAF logs and tune managed/custom rules carefully.
• Private Link origin unavailable: verify the private endpoint approval and supported origin configuration.
• Custom domain validation fails: verify DNS ownership records and propagation.

Best practices#

• Use Standard or Premium for all new deployments.
• Prefer Premium when Private Link origin protection or advanced WAF capabilities are required.
• Use multiple healthy origins for resiliency.
• Cache only content that is safe to share between users.
• Restrict direct access to origins when possible.
• Monitor Front Door metrics, WAF logs and origin health.
• Use Application Gateway behind Front Door when you need both global edge delivery and regional Layer 7 control.

Official references#

• Create Azure Front Door Standard/Premium
• Secure Azure Front Door
• Configure caching
• Front Door Classic retirement

Related Melochip articles: Azure Application Gateway and Azure Traffic Manager.

Azure Application Gateway

Azure Traffic Manager