Azure Front Door

Azure Front Door is Microsoft's content delivery network and application entry point for web traffic. Microsoft describes it as a CDN that delivers static and dynamic content from points of presence close to users, and as a layer 7 load balancer that routes requests across origins in several regions. It runs on Microsoft's global edge network, which the documentation puts at more than 118 edge locations across 100 metro areas.

Origins can sit in Azure or anywhere else. It comes in two current tiers, Standard for delivery and Premium for security, plus a classic version that is being retired. The service handles TLS offload, custom domains, caching, routing rules, health probes and, on Premium, a web application firewall. Microsoft places it next to Azure Load Balancer and Application Gateway as one of three load-balancing and delivery services in Azure.

• Edge caching and acceleration. Static files are cached at edge locations, and dynamic requests use split TCP connections over Microsoft's network. Microsoft says this can improve application latency by up to three times, and supports HTTP/2, IPv6 and WebSockets.
• Layer 7 routing and failover. Path-based routing, origin load balancing and health probes decide where each request goes. Microsoft's FAQ describes near real-time failover between regions and endpoints when an origin stops responding.
• Rules engine. Redirects, rewrites, header changes and cache behaviour are set in a rules engine that supports regular expressions and server variables, so routing logic can run at the edge instead of in your application.
• Managed certificates. Microsoft says certificates are free and rotated automatically, and you can bring your own for custom domains. TLS 1.2 and 1.3 are supported. Custom certificate updates can take up to an hour to reach every location.
• WAF and bot protection. Premium adds the Microsoft-managed rule set, bot protection, security analytics and threat intelligence integration. A CAPTCHA add-on is priced separately. Layer 3 and 4 DDoS protection is built into the platform.
• Private Link to origins. On Premium, traffic from the edge to supported origins such as internal load balancers, Storage blobs, App Service and static websites can stay on a private connection that the origin owner approves.
• Reports and logs. Built-in reports cover traffic and security patterns. Access logs, WAF logs and health probe logs can go to a storage account, Event Hubs or Azure Monitor, and you choose how long to keep them.

• A company hosting a web app on Azure App Service. Microsoft says transfer from an origin in an Azure data centre to Front Door is free. A team can put Front Door in front of two App Service instances in different regions and route visitors to the closer healthy one.
• A security team protecting a public API. Premium bundles WAF, bot rules and Private Link into its price. The team can attach a WAF policy while creating the profile and keep the origin off the public internet by approving a private endpoint request.
• A media site serving large downloads in Europe. Pricing is metered per GB out of the edge, with a Europe rate on the pricing page. The site can watch usage by zone in the built-in reports and weigh the Standard base fee against traffic volume.

In the Azure portal you select Create a resource, search for Front Door and CDN profiles, and choose Quick create or Custom create. Quick create asks for a subscription, resource group, profile name, tier (Standard or Premium), an endpoint name that must be globally unique, the origin type and host name, and optional caching and a WAF policy.

Microsoft notes the new profile can only use origins from the same subscription at creation. Configuration then takes a few minutes to reach all edge locations; the FAQ gives up to 15 minutes for a single change and about 10 minutes for a cache purge. Bicep, ARM templates, the Azure CLI and PowerShell are supported for repeatable setups.

Billing has a fixed monthly base fee for Standard or Premium, then data transfer to the client, transfer to the origin and requests.

The base fee applies even to a site with little traffic, and the web application firewall and Private Link come only with Premium. Transfer from an origin in an Azure data centre is free, which favours sites already running there.

Azure Front Door is entry #11 of 12 in the CDN providers list: the products next to it are Amazon CloudFront above and Google Cloud CDN below. Challengers hold places 1 to 3 where a category has them; the number here is a place in the order, not a mark out of ten.

Home market: the United States, one of 8 North America bases among the 12 products here.

Pricing as recorded: Base fee per tier plus metered transfer and requests, published.

The pricing page lists a fixed monthly base fee of $35 for Standard and $330 for Premium, billed hourly for the hours used. On top come metered outbound transfer to the client, outbound transfer to the origin, and requests. For the Europe zone, client transfer is $0.083 per GB for the first 10 TB a month, $0.066 for the next 40 TB and $0.057 for the next 100 TB. Transfer to origin is $0.02 per GB. Requests cost $0.009 per 10,000 on Standard and $0.015 on Premium for the first 250 million. Larger volumes say Contact Us. Prices are in US dollars and described as estimates.

We took this from azure.microsoft.com/products/frontdoor, the vendor’s own site, when we reviewed Best CDN Providers in 2026; that review is dated 5 November 2026.

Hosting follows your choice of origins, since Front Door is a global edge service and no single data region is stated on the pages we read. Microsoft states that layer 3 and 4 DDoS protection is built in and that TLS 1.2 and 1.3 are supported.

Premium adds a managed WAF rule set and Private Link. Logs go to destinations you control. Compliance certificates and data residency terms are not listed on the Front Door pages we read, so check the Azure compliance documentation separately.

Integrations the vendor names (12):

• Azure DNS
• Azure App Service Web Apps
• Azure Storage
• Azure Monitor
• Azure Key Vault
• Azure Policy
• Azure Advisor
• Azure Private Link
• Azure Event Hubs
• Bicep
• Azure Resource Manager templates
• Azure CLI and PowerShell

Shared tags and a similar price model decide who is listed here; where none match, the neighbours in the ranking fill in.

• Fastly (#7 of 12): Programmable edge CDN with metered regions and a starter allowance. Watch out: bandwidth costs twelve cents per gigabyte in Europe and North America at the first tier.
• Akamai (#9 of 12): Many separate delivery products, priced after a sales conversation. Best for: Enterprises with sales-led procurement and a team to configure properties.
• Amazon CloudFront (#10 of 12): Not for: buyers who want one product without an AWS account. AWS CDN with flat monthly plans or metered usage.
• Google Cloud CDN (#12 of 12): Google edge cache attached to a cloud load balancer.

Read from the vendor’s own pages on 5 November 2026.

• learn.microsoft.com/en-us/azure/frontdoor/front-door-overview: Product description, edge locations, benefits, DDoS note
• azure.microsoft.com/en-us/pricing/details/frontdoor: Base fees, transfer and request prices, add-ons, tier descriptions
• learn.microsoft.com/en-us/azure/frontdoor/standard-premium/tier-comparison: Tier feature comparison, classic retirement dates, TLS versions
• learn.microsoft.com/en-us/azure/frontdoor/create-front-door-portal: Quick create steps and Private Link approval
• learn.microsoft.com/en-us/azure/frontdoor/front-door-faq: Propagation times, purge limits, diagnostic logs

We rank on what separates products after the demo: time to useful, the real price, the exit and who the product is for. Here that gives Azure Front Door the #11 position in a list of 12. Details: how we rank software.