Azure Application Gateway vs Front Door: Complete Comparison and L7 Load Balancer Selection Guide

Their scope. Application Gateway is a regional L7 load balancer deployed into a VNet inside a specific region, distributing traffic to backends in that region. Front Door is a global L7 load balancer + CDN that receives traffic at 300+ Microsoft Edge Locations worldwide and routes to the nearest backend region. Application Gateway is built for single-region web apps; Front Door is built for multi-region deployments and global users. The two are not competitors — they are complementary, and a common pattern is to layer them: Front Door at the global edge, Application Gateway for in-region L7 routing to AKS / VMs.

Yes, both do. Application Gateway WAF v2 and Front Door WAF Premium offer roughly the same feature set (OWASP Core Rule Set CRS 3.2, custom rules, bot protection, geo-filtering, rate limiting). The difference is where the policy applies: Application Gateway WAF runs in-region, while Front Door WAF runs at the global edge. Both integrate with Microsoft Defender for Cloud Apps. Front Door Premium is also integrated with Azure DDoS Protection, absorbing attacks at the edge. The rule of thumb: Front Door + WAF Premium for global DDoS defense, Application Gateway WAF v2 for a consolidated in-region WAF.

Front Door has three SKUs sold in parallel: Front Door Classic (the legacy SKU, closed to new deployments since 2024 and only supported for existing tenants), Front Door Standard, and Front Door Premium. Standard and Premium are the redesigned 2022 generation and offer more capability than Classic. Standard: basic global L7 load balancer + CDN, fixed 35 USD/month + usage. Premium: Standard + WAF Premium + Private Link integration + Bot Manager + Managed Identity, fixed 330 USD/month + usage. Microsoft now recommends only Standard or Premium for greenfield projects — avoid Classic. Choose Premium if you need WAF; Standard is enough for a simple CDN.

Application Gateway (focused on the WAF v2 SKU) provides: 1) URL Path-based Routing (e.g., /api → API Server, /images → CDN); 2) Host-based Routing (e.g., api.example.com → AKS Service A, shop.example.com → AKS Service B); 3) SSL Termination (Azure decrypts SSL and forwards to backends over HTTP, offloading CPU); 4) SSL Re-encryption (backends receive HTTPS, end-to-end encryption); 5) Session Affinity (cookie-based session stickiness); 6) Auto-scaling (Min 0 – Max 125 instances); 7) Custom Probes (configurable backend health checks); 8) Web Application Firewall v2 (OWASP CRS 3.2); 9) Connection Draining (safe backend removal during deployments); 10) Mutual Authentication (mTLS). SLA is 99.95%.

Front Door Premium provides: 1) Anycast IP + automatic routing to the nearest of 300+ global Edge Locations; 2) Geo-filtering (country-level access control); 3) URL Rewrite / Redirect; 4) Rules Engine (custom request/response manipulation); 5) Caching (CDN function, static content cached at the edge); 6) WAF Premium (OWASP CRS 3.2, Bot Manager, JS Challenge); 7) DDoS Protection integration (Network / IP Protection); 8) Private Link integration (direct delivery to backend Private Endpoints); 9) Origin Health Probe (automatic backend failover); 10) Session Affinity; 11) HTTP/2 and HTTP/3 (QUIC) support. SLA is 99.99%.

The standard pattern for global multi-region deployments: 1) Front Door is the global edge layer + WAF Premium, receiving all traffic; 2) Each region's Application Gateway is registered as a Front Door origin; 3) Application Gateway then routes within its region to AKS / VMs / App Services. This delivers a three-tier architecture — global WAF + in-region L7 routing + backend distribution. The bill (Front Door Premium + Application Gateway WAF v2 × number of regions) reaches several hundred thousand yen per month, but you get enterprise-grade reliability and security. A simpler variant — Front Door alone, delivering directly to AKS / App Service — is also viable, with Application Gateway omitted entirely.

Azure has four traffic-control services: 1) Front Door (global L7 + CDN + WAF, HTTP/HTTPS only); 2) Application Gateway (regional L7 + WAF, HTTP/HTTPS only); 3) Traffic Manager (global DNS-based routing, protocol-agnostic across L4/L7); 4) Azure CDN (pure content-delivery CDN — a subset of Front Door's features). Since Front Door's launch, standalone use cases for Azure CDN and Traffic Manager have shrunk. Traffic Manager still earns its keep when you need DNS-level failover (e.g., multi-cloud failover between Azure and AWS), while Azure CDN survives only in legacy scenarios. The industry trend is clear: pick Front Door for new projects.

AZ-700 (Network Engineer Associate) covers Application Gateway and Front Door in depth — routing rules, WAF, SSL configuration, and selection decisions are all frequent topics. AZ-104 (Administrator) covers the basics in Domain 4. AZ-305 (Solutions Architect Expert) asks for the architect-level decision of which to use when. SC-100 / SC-500 (Cybersecurity Architect / Security Engineer) cover WAF design and DDoS countermeasures. In practice, every public-facing Azure web project ends up using one (or both) of these as a core service, so deep familiarity is essential for any Azure network engineer.