The AZ-700 exam's global traffic management section asks when to use Front Door versus Traffic Manager. Both services route users to the best backend worldwide, but they operate in fundamentally different ways. Think of a global franchise cafe network: some branches directly greet customers and make drinks, while others simply guide visitors to the nearest suitable location.
Azure Front Door: The Global Entry Point
When you check in at an airport, the airline counter takes your luggage, issues a boarding pass, and forwards everything to your destination. You never contact the destination airport directly. Azure Front Door works exactly like that counter. It terminates client connections at more than 200 Points of Presence (PoPs) around the world and then establishes separate connections to your backend origins. This reverse-proxy architecture means TLS negotiation finishes close to the user, dramatically cutting round-trip latency.
Front Door uses Anycast routing so that a user's DNS query lands on the nearest PoP automatically. Once connected, it can cache HTTP(S) responses at the edge, apply a Web Application Firewall (WAF) to block SQL Injection and XSS attacks before traffic reaches your servers, and distribute load across an Origin Group with configurable weights and priorities. Automatic failover is built in: if one origin becomes unhealthy, Front Door reroutes traffic to healthy origins within seconds.
Front Door Standard vs Premium
Like a warehouse membership club with standard and premium tiers, Front Door offers two SKUs that share most features but diverge on security depth and Private Link support.
| Feature | Standard | Premium | |:--------|:---------|:--------| | WAF managed rule sets | Basic | Microsoft-managed rules + Bot Protection | | Private Link backend | Not supported | Supported | | Security reports | No | Yes |
Private Link backend connectivity lets Front Door reach your origin servers without exposing them to the public internet. A Premium PoP connects to your backend through a private endpoint inside your virtual network. This matters most in regulated industries like finance and healthcare where backends must never be publicly reachable. Bot Protection identifies and blocks automated scraping bots and credential-stuffing attacks at the edge.
Traffic Manager: The DNS Signpost
Imagine a highway junction where signposts direct drivers toward different cities. The signs themselves don't move any cars — they just tell drivers which road to take. Azure Traffic Manager plays exactly that signpost role. It does not touch your traffic at all. Instead, it returns DNS responses that contain the IP address of the most appropriate endpoint, and the client connects directly to that endpoint.
Because Traffic Manager operates purely at the DNS layer, it is protocol-agnostic. You can place any publicly reachable endpoint behind it: Azure VMs, App Services, on-premises servers, or endpoints in other clouds. If your workload is not HTTP-based — say, a game server using TCP or a trading platform using UDP — Traffic Manager is the right global routing tool. Health probes continuously check each endpoint, and unhealthy ones are removed from DNS responses automatically.
Traffic Manager's Six Routing Methods
A logistics company can assign deliveries by shortest route, by warehouse capacity, by a primary-then-backup rule, or by customer region. Traffic Manager offers six routing methods to cover these patterns.
: sends users to the endpoint with the lowest measured latency — most commonly tested : maps a client's country or continent to a specific endpoint — enforces data sovereignty : one primary endpoint handles all traffic; others act as failover targets : splits traffic by percentage (e.g., 70/30) — enables canary deployments : returns multiple healthy IPv4/IPv6 endpoints in one DNS response; client picks one : maps specific client IP ranges to specific endpoints — useful for internal vs external routing
Choosing Between Front Door and Traffic Manager
A shopping mall has both a main entrance and directional signs in the parking lot. The entrance actually greets and serves customers; the signs just point the way. Neither replaces the other, but they solve different problems. Front Door is the entrance; Traffic Manager is the sign.
| Criteria | Azure Front Door | Traffic Manager | |:---------|:-----------------|:----------------| | Traffic handling | Direct at edge (L7 proxy) | DNS response only, no direct handling | | Protocol support | HTTP/HTTPS only | Any protocol | | Caching and WAF | Built in | None | | Operating layer | Application (L7) | DNS | | Connection model | Reverse proxy | Client connects directly |
One decision question covers most scenarios: "Do I need HTTP(S) acceleration and WAF at the edge?" Yes means Front Door; No means Traffic Manager (or both working together for layered routing).
!Front Door versus Traffic Manager
Azure CDN Integration and the Migration Path
Like an old building being torn down and replaced with a new one, Microsoft is gradually consolidating its legacy Azure CDN offerings — Akamai- and Verizon-based profiles — into Front Door Standard and Premium. When an exam scenario mentions needing a CDN for a web application, reach for Front Door first. Classic Azure CDN profiles are scheduled for retirement after 2027, so any architecture exam question about long-term CDN strategy should point to Front Door Standard or Premium.
Front Door's caching layer stores static assets — images, CSS, JavaScript — at edge PoPs, reducing load on origin servers. Cache rules let you tune TTL, query-string handling, and cache keys with far more granularity than classic CDN profiles, making Front Door a more flexible long-term platform.
Common Pitfall: DNS TTL and Instant Failover
If a printed address directory lists the wrong address, visitors will keep going to the wrong location until the next edition is printed. Traffic Manager's DNS TTL problem works exactly like that. Because Traffic Manager works through DNS, a client that cached the old endpoint's IP will keep connecting there until the TTL expires — even after Traffic Manager has detected a failure and updated its response. Setting a low TTL (e.g., 20 seconds) reduces the window but adds DNS query overhead.
Front Door avoids this entirely because it proxies connections directly and can reroute within seconds of detecting an unhealthy origin. When near-instant failover is listed as a requirement, Front Door is the answer. That said, Traffic Manager's simplicity and protocol flexibility make it valuable on its own, and the two services can be layered: Traffic Manager routes to regional Front Door instances, combining DNS-level global distribution with L7 acceleration and WAF protection.
Exam Key Takeaways
"Global HTTP acceleration + WAF" -- Azure Front Door "Global routing for non-HTTP services" -- Traffic Manager "Service that does not process traffic directly" -- Traffic Manager (DNS-based) "Edge caching and TLS termination" -- Azure Front Door "Data sovereignty, allow only specific countries" -- Traffic Manager Geographic routing "Route users to the nearest region" -- Traffic Manager Performance or Front Door Anycast "Failover to standby when primary is down" -- Traffic Manager Priority "Canary deployment 70/30 split" -- Traffic Manager Weighted "Private Link backend + Bot Protection" -- Front Door Premium "Basic WAF + CDN" -- Front Door Standard "Replace Azure CDN classic" -- Migrate to Front Door Standard or Premium "Near-instant failover without DNS TTL delay" -- Front Door (proxy-based)
Front Door = edge L7 proxy + WAF + cache; Traffic Manager = DNS signpost only (no traffic processing)