For most solutions, choose either Azure Front Door for content caching, CDN, TLS termination, and WAF, or Traffic Manager for simple global load balancing.
Front Door's features perform optimally when traffic exclusively comes through Front Door. It's advised to set up your origin to deny access to traffic that bypasses Front Door.
Click the Azure Resource Graph tab to view the query
//under-development
Use the latest API version and SDK version
Impact:MediumCategory:Scalability
APRL GUID:52bc9a7b-23c8-bc4c-9d2a-7bc43b50104a
Description:
When working with Azure Front Door through APIs, ARM templates, Bicep, or SDKs, using the latest API or SDK version is crucial. Updates bring new functions, important security patches, and bug fixes.
Click the Azure Resource Graph tab to view the query
//under-development
Configure logs
Impact:MediumCategory:Monitoring and Alerting
APRL GUID:1ad74c3c-e3d7-0046-b83f-a2199974ef15
Description:
Front Door logs offer comprehensive telemetry on each request, crucial for understanding your solution's performance and responses, especially when caching is enabled, as origin servers might not receive every request.
Click the Azure Resource Graph tab to view the query
//under-development
Use end-to-end TLS
Impact:HighCategory:Security
APRL GUID:d9bd6780-0d6f-cd4c-bc66-8ddcab12f3d1
Description:
Front Door terminates TCP and TLS connections from clients and establishes new connections from each PoP to the origin. Securing these connections with TLS, even for Azure-hosted origins, ensures data is always encrypted during transit.
Using HTTPS is ideal for secure connections. However, for compatibility with older clients, HTTP requests may be necessary. Azure Front Door enables auto redirection of HTTP to HTTPS, enhancing security without sacrificing accessibility.
When Front Door manages your TLS certificates, it reduces your operational costs and helps you to avoid costly outages caused by forgetting to renew a certificate. Front Door automatically issues and rotates the managed TLS certificates.
Click the Azure Resource Graph tab to view the query
//under-development
Use latest version for customer-managed certificates
Impact:MediumCategory:High Availability
APRL GUID:4638c2c0-03de-6d42-9e09-82ee4478cbf3
Description:
If you use your own TLS certificates, set the Key Vault certificate version to 'Latest' to avoid reconfiguring Azure Front Door for new certificate versions and waiting for deployment across Front Door's environments.
Click the Azure Resource Graph tab to view the query
//under-development
Use the same domain name on Front Door and your origin
Impact:MediumCategory:Governance
APRL GUID:cd6a32af-747a-e649-82a7-a98f528ca842
Description:
Front Door can rewrite Host headers for custom domain names routing to a single origin, useful for avoiding custom domain configuration at both Front Door and the origin.
Click the Azure Resource Graph tab to view the query
//under-development
Enable the WAF
Impact:MediumCategory:Security
APRL GUID:1bd2b7e8-400f-e64a-99a2-c572f7b08a62
Description:
For internet-facing applications, enabling the Front Door web application firewall (WAF) and configuring it to use managed rules is recommended for protection against a wide range of attacks using Microsoft-managed rules.
Consider selecting a webpage or location specifically designed for health monitoring as the endpoint for Azure Front Door's health probes. This should encompass the status of critical components like application servers, databases, and caches to serve production traffic efficiently.
Click the Azure Resource Graph tab to view the query
//under-development
Use HEAD health probes
Impact:MediumCategory:Scalability
APRL GUID:5783defe-b49e-d947-84f7-d8677593f324
Description:
Health probes in Azure Front Door can use GET or HEAD HTTP methods. Using the HEAD method for health probes is a recommended practice because it reduces the traffic load on your origins, being less resource-intensive.
Click the Azure Resource Graph tab to view the query
//under-development
Secure your Origin with Private Link in Azure Front Door
Impact:MediumCategory:Security
APRL GUID:1cfe7834-56ec-ff41-b11d-993734705dba
Description:
Azure Private Link enables secure access to Azure PaaS and services over a private endpoint in your virtual network, ensuring traffic goes over the Microsoft backbone network, not the public internet.
Click the Azure Resource Graph tab to view the query
//under-development
Avoid using Classic Azure Front Door
Impact:HighCategory:Service Upgrade and Retirement
APRL GUID:82fa3cff-74bd-4063-b726-834f160592fa
Description:
Azure Front Door standard is ~45% cheaper then AFD classic and has many additional benefits. Classic is also scheduled to be retired on March 31, 2027.