Load Balancing
Front Door · Traffic Manager · Application Gateway · Load Balancer
Practice questions for this topic →
Decision table
| Service | Scope | Layer | WAF | Pick when… |
|---|---|---|---|---|
| Front Door (Standard/Premium) | Global | L7 HTTP(S) | Yes | Global web app: edge caching, TLS offload at the edge, fast failover, 118+ edge locations |
| Traffic Manager | Global (DNS) | DNS | No | DNS routing for any protocol; no TLS termination |
| Application Gateway v2 | Regional | L7 HTTP(S) | Yes | URL path routing, multi-site hosting, TLS termination, cookie affinity, autoscale, zones, AGIC for AKS |
| Load Balancer (Standard) | Regional (+ global tier) | L4 TCP/UDP | No | Non-HTTP, ultra-low latency, VM and scale set backends; 99.99% SLA |
| Gateway Load Balancer | Regional | L3/L4 | No | Transparently insert third-party NVAs |
Retired: Basic Load Balancer (Sep 30, 2025) and Application Gateway v1 (Apr 28, 2026). Retiring: Front Door (classic) on Mar 31, 2027 and CDN Standard from Microsoft (classic) on Sep 30, 2027. Microsoft says you can combine these services.
Load Balancer details
- Standard vs Basic (retired): Standard is closed to inbound unless a network security group allows it, supports zone-redundant or zonal frontends, TCP/HTTP/HTTPS probes, HA ports, outbound rules and a global tier; TCP connections stay alive when one or all probes go down. Basic was open by default, had no zones and no SLA.
- HA ports (internal Standard LB): frontend and backend ports 0 and protocol All balance every TCP and UDP flow, decided per five-tuple; the standard pattern for highly available NVAs.
- Global (cross-region) load balancer: static anycast IP (IPv4 and IPv6), geo-proximity routing to the closest healthy regional load balancer, health probes about every 5 seconds, client IP preserved, layer 4.
- Gateway Load Balancer: 'bump in the wire' that chains to a Standard public load balancer frontend or a NIC IP configuration, uses VXLAN, keeps flow stickiness for symmetry, inspects inbound and outbound traffic, and can't be a UDR next hop.
Traffic Manager routing methods
| Method | Use when… |
|---|---|
| Priority | Primary endpoint with ordered backups (failover) |
| Weighted | Spread by weight (equal weights = even) |
| Performance | Endpoints in several locations; send users to the closest for lowest latency |
| Geographic | Direct users by the location of their DNS query: data sovereignty, localization |
| Multivalue | Return all healthy IPv4/IPv6 endpoints |
| Subnet | Map user IP ranges to specific endpoints |
One method per profile; a change applies within a minute; nest profiles to combine methods. Every profile has health monitoring and automatic failover.
Front Door tiers
- WAF: Azure WAF is natively integrated with Front Door Premium with full capabilities; for Standard only custom rules are supported. Managed rule sets include the IP Reputation Rule Set for malicious bots. Custom rules run before managed rule sets, except the HTTP DDoS ruleset, which runs first.
- Private Link origins are Premium-only. Front Door doesn't support client/mutual authentication (mTLS) for public or Private Link origins. To keep traffic from bypassing Front Door, restrict the origin: Private Link (Premium), managed identities (Standard or Premium), IP address filtering, or the Front Door identifier.
- Billing: a base fee per profile billed hourly, plus request and data-transfer fees; Microsoft's illustrative figures are $35 a month (Standard) and $330 (Premium). Premium adds no fee for managed WAF rule sets or Private Link origins. Front Door (classic) has no base fee but higher request and transfer rates; do a cost analysis before migrating.
- Classic → Standard/Premium uses the migration capability; Standard → Premium uses upgrade; there's no seamless downgrade from Premium to Standard (re-create the profile).
- Timeline (Microsoft Learn): since Aug 15, 2025 Front Door (classic) and CDN (classic) no longer support new profiles, new domains or managed certificates; managed certificates that renewed automatically before that date remain valid until Apr 14, 2026; Front Door (classic) retires Mar 31, 2027; CDN Standard from Microsoft (classic) retires Sep 30, 2027.
- Premium adds managed WAF rule sets and Private Link origins; use a WAF with Front Door, which also gives platform-level DDoS protection.
Exam Tips
Tick each tip once you can answer it without looking.
“Route /images to one pool and /api to another” → Application Gateway (or Front Door if global). Trap: Load Balancer can't see URL paths.
“Global routing for TCP/UDP (non-HTTP)” → Traffic Manager (or cross-region Load Balancer). Trap: Front Door is HTTP(S) only.
“Fastest failover between regions for a web app” → Front Door. Trap: Traffic Manager depends on DNS TTL and client caching.
“Protect a regional web app from SQL injection / OWASP attacks” → Application Gateway with WAF. Trap: NSGs and Azure Firewall aren't web application firewalls.
“Global routing + private regional backends” → Front Door → Application Gateway → VMs/AKS.
“Front Door must reach an origin with no public endpoint” → Front Door Premium + Private Link.
“Load balance all ports/protocols to a pair of NVAs” → Standard internal Load Balancer with HA Ports.
“Insert third-party firewall appliances transparently in the traffic path” → Gateway Load Balancer.
“Basic Load Balancer or App Gateway v1 appears as an answer” → Pick Standard LB / App Gateway v2: the older SKUs are retired.
“Route users to the closest region by DNS” → Traffic Manager performance routing. Trap: Other methods: priority, weighted, geographic, multivalue, subnet.
“Application Gateway v2 capabilities” → URL path routing, multi-site hosting, rewrite, cookie affinity, TLS termination, WAF, autoscale, zone redundancy, static VIP, AGIC. Trap: v1 retired Apr 28, 2026.
“Traffic Manager routing methods” → Priority, weighted, performance, geographic, multivalue, subnet: one per profile, changes apply within a minute. Trap: Nest profiles to combine methods.
“Cross-region (global) Load Balancer” → Static anycast IP, geo-proximity routing, health probes about every 5 seconds, client IP preserved. Trap: Layer 4 only; backends are regional load balancers.
“How Gateway Load Balancer works” → Chains to a Standard public LB frontend or NIC IP, uses VXLAN, keeps flow stickiness. Trap: It can't be a UDR next hop.
“HA ports load balancing rule” → Internal Standard LB, ports 0 and protocol All, decided per five-tuple. Trap: Used for NVA high availability.
“Standard Load Balancer defaults” → Closed to inbound until an NSG allows it; zone-redundant frontends; 99.99% SLA; TCP, HTTP, HTTPS probes. Trap: Basic (retired Sep 30, 2025) was open by default with no zones or SLA.
“Moving between Front Door tiers” → Classic to Standard/Premium by migration; Standard to Premium by upgrade. Trap: No seamless downgrade from Premium to Standard.
“Which global service when” → DNS routing without TLS termination: Traffic Manager. Web performance and fast failover: Front Door. Transport layer: Load Balancer. Trap: You can combine them.
“Front Door WAF with managed rule sets, or Private Link to origins” → Front Door Premium. Trap: Standard supports custom WAF rules only; there's no mTLS to public or Private Link origins on either tier.
“Front Door billing” → A base fee per profile billed hourly plus request and data-transfer fees (Microsoft's example: $35 a month Standard, $330 Premium); no extra fee for Premium's managed WAF or Private Link. Trap: Front Door (classic) has no base fee but higher request and transfer rates.
“Stop traffic bypassing Front Door at the origin” → Private Link (Premium), managed identities (Standard or Premium), IP address filtering, or the Front Door identifier. Trap: Otherwise traffic can skip the WAF and DDoS protection.
“Order a Front Door WAF policy processes rules” → HTTP DDoS ruleset first, then custom rules, then managed rule sets. Trap: Within a policy, rules run by priority: a smaller number is a higher priority.
“Front Door (classic) and CDN (classic) timeline” → Aug 15, 2025 no new profiles, domains or managed certificates; Apr 14, 2026 end of the older managed certificates; Mar 31, 2027 Front Door classic retires; Sep 30, 2027 CDN classic retires. Trap: Premium to Standard has no seamless downgrade tool.