Azure Front Door, What It Does and When You'd Actually Use One

If you've deployed a web app in Azure and then gone looking for a way to add a custom domain, a bit of caching, and some protection against a backend going down, you've probably run into Azure Front Door. It shows up in the portal next to Application Gateway and Load Balancer, and it's not always obvious which one you actually need.

Front Door is a global entry point for your web traffic. You point your domain at it, and it decides which backend gets each request. That backend could be an App Service in one region, a second App Service in another region as a backup, a storage account serving static files, or a mix of all three. Front Door checks the health of each one and quietly stops sending traffic to anything that's down.

What it's actually good for

The most common reason people turn it on is a free managed SSL certificate on a custom domain, without having to renew anything by hand. After that, the next most common reason is having a site in two Azure regions and wanting automatic failover if one goes down, without the visitor noticing anything changed.

It also caches static content like images, CSS, and JavaScript at edge locations closer to your visitors, which can make a slow-loading site feel noticeably faster for people far from your primary region. And it includes a basic web application firewall you can turn on to block common attack patterns before they ever reach your app.

When you don't need it

If you have one app in one region with no plans to expand, Front Door is probably overkill. App Service already gives you a free SSL certificate on its own domain, and you can buy a certificate for a custom domain without adding another layer in front of everything. Adding Front Door for a single-region site mostly adds cost and one more thing to configure without much benefit.

It's also not the right tool if what you actually need is to balance traffic between virtual machines inside a single region and virtual network. That's more squarely Azure Load Balancer or Application Gateway territory. Front Door works at a global, DNS level, routing traffic to entire regions or backend pools, not to individual VMs on a private network.

If you're only running one app in one place, skip it for now. Once you add a second region, or a custom domain becomes a recurring headache, it's worth a look.