Microsoft Azure services
11 / 24
Microsoft Azure

Content Delivery — Front Door & Azure CDN

Serve content from the edge, fail over between regions, and filter traffic before it reaches your origin.

Azure Front Door is a global entry point: CDN caching, layer-7 load balancing and WAF, at Microsoft's edge.

A chain of regional depots with a dispatcher. Common stock is held locally; anything else is fetched from whichever warehouse is nearest and still open.

Key Concepts

1
    user -> Front Door edge (anycast) -> [cache hit]  served at the edge
                                      -> [miss] -> origin group
                                                   backend A (ap-south)
                                                   backend B (west-eu)
2
It is more than a CDN, and that is the distinction interviewers want. Azure CDN caches static content. Front Door also does global load balancing, health probes, failover and path-based routing — so it is the front door for the whole application, not just its assets.
3
Routing picks an origin.
    latency      the closest healthy backend
    priority     active-passive failover
    weighted     canary or gradual migration
    session affinity   pin a user to one backend
4
Health probes drive failover, and they are fast — unlike DNS failover, where resolvers cache the old answer for the TTL. Front Door withdraws an unhealthy backend within seconds because clients connect to the edge, not to the backend address.
5
Caching is governed by rules.
    /static/*   cache 1 year, ignore query strings
    /api/*      disable cache entirely
    default     honour the origin's Cache-Control
6
The cache key mistake is the same everywhere. Including a per-user cookie or a cache-busting query string in the key makes every request unique, so the hit rate goes to zero and you pay for a CDN that caches nothing.
7
Purge is the escape hatch, not the plan. Versioned filenames — app.8f3c2a.js — are better, because a new name is simply a new object.
app.8f3c2a.js
8
WAF at the edge blocks the OWASP top ten, bad bots and floods far from your origin, with managed rule sets and rate limiting by IP.
9
Private Link to the origin lets Front Door reach an App Service or storage account that has no public endpoint at all, so nobody can bypass the edge.
10
What the interviewer is probing.1. "Front Door or Azure CDN?" Probing: whether you know the overlap. Stalls: "They are the same." Moves up: CDN caches static content; Front Door adds global load balancing, health probes, failover and path routing, so it fronts the whole application.
11
2. "Why is Front Door failover faster than DNS failover?" Probing: where the decision happens. Stalls: "It is not." Moves up: clients connect to the edge, which already knows which origin is healthy — DNS failover waits for resolver caches to expire.
12
3. "Your cache hit rate collapsed after a release. What would you check?" Probing: the cache key. Stalls: "Traffic changed." Moves up: a cache-busting query string or a cookie now in the key, making every request unique.
13
4. "How do you keep the origin unreachable except through Front Door?" Probing: Private Link. Stalls: "Firewall rules by IP." Moves up: Private Link to the origin, so the App Service or storage account has no public endpoint at all.
Use cases:front-doorcdnwaffailovercaching