Front Door vs Application Gateway: global edge vs regional layer 7
Both are layer-7. Both route by URL. Both bolt on a web application firewall. So people treat them as interchangeable — and pick wrong. The difference is one word: where. One lives inside a single region; the other lives at Microsoft's global edge.
New to cloud? CAMPUX is a free, build-first course. Start here →
Azure has a shelf of things that sit in front of your web app, and two of them look almost identical on the feature list: Application Gateway and Front Door. Both understand HTTP, both route on URL paths and host headers, both can run a WAF, both terminate TLS. If you compare them by bullet points you will conclude they are twins. They are not — they operate at completely different altitudes, and knowing which altitude your problem lives at is the whole decision.
Application Gateway: the regional doorman
Microsoft's definition is plain: Application Gateway is "a web traffic load balancer that helps you manage traffic to your web applications," making "intelligent routing decisions based on HTTP request attributes like URL paths and host headers." It operates at OSI layer 7, and — this is the key word — it is regional. It lives inside a virtual network, in one region, in front of the backends in that region.
Its job is to take traffic that has already arrived at your region and distribute it intelligently among your servers: send /images to one pool and /video to another, terminate TLS, run a WAF, autoscale, spread across availability zones. Think of it as the doorman inside one building, deciding which floor each visitor goes to. It is excellent at that — and it has no idea that your building might have a twin on another continent.
Front Door: the global edge
Front Door plays a bigger geography. Microsoft describes it as "an advanced content delivery network (CDN) for the cloud," using Microsoft's "extensive global edge network" of 100-plus points of presence positioned close to users worldwide. It is global, and it sits at the edge — the first Microsoft thing a user's request touches, wherever on earth that user is.
From that edge it does things a regional gateway structurally cannot: catch the request at the nearest point of presence (anycast), accelerate it across Microsoft's private backbone (split TCP), cache static content near the user (CDN), terminate TLS at the edge, run a WAF at the edge, and load-balance across origins in different regions — failing traffic over to a healthy region if one goes dark. Front Door is not the doorman inside one building; it is the global concierge network deciding which building — which region — each user should be sent to in the first place.
Application Gateway spreads traffic across servers in a region. Front Door spreads traffic across regions, at the edge, near the user.
| Application Gateway | Front Door | |
|---|---|---|
| Reach | Regional (one region / VNet) | Global (Microsoft edge) |
| Layer | Layer 7 (HTTP/S) | Layer 7 (HTTP/S) at the edge |
| Load-balances across | Servers within a region | Origins across regions |
| CDN caching | No | Yes |
| WAF | Yes (regional) | Yes (at the edge) |
| URL / host routing | Yes | Yes |
| Lives in your VNet | Yes | No — it is a global service |
So which do you choose?
- One region, routing traffic among backends? Application Gateway. If your app runs in a single region and you need layer-7 routing, TLS termination, and a WAF in front of the servers there, the regional doorman is exactly right — and simpler.
- Global audience, multiple regions, or you want edge caching and acceleration? Front Door. If users are worldwide, or you run in more than one region and want automatic failover between them, you need something that lives at the edge and thinks in continents.
The grown-up pattern for a large global app uses both: Front Door at the global edge for caching, acceleration, and cross-region routing, with an Application Gateway inside each region doing fine-grained layer-7 routing to the servers there. Global concierge out front, regional doorman in each building. Naming that combination in an interview signals you understand the altitudes rather than memorising a feature list. For the DNS-based global alternative, see Front Door vs Traffic Manager; for the regional layer-4 versus layer-7 split underneath, Load Balancer vs Application Gateway.
The one line to remember
When two services share a feature list, stop comparing features and compare scope. Application Gateway is regional; Front Door is global. Every other difference — the CDN, the anycast, the cross-region failover — falls out of that single fact. Ask where your traffic problem lives, at the edge or inside a region, and the choice makes itself.
Questions people also ask
What is the difference between Azure Front Door and Application Gateway?
Both are layer-7 services with routing and a WAF, but they operate at different altitudes. Application Gateway is regional: it lives inside one VNet and distributes traffic among servers in that region. Front Door is global: it sits at Microsoft's edge network and routes users to the nearest healthy region.
Can you use Front Door and Application Gateway together?
Yes, and for a large global app you usually should. Front Door sits at the global edge doing caching, acceleration, and cross-region failover. An Application Gateway inside each region then handles fine-grained layer-7 routing to the backend servers there. Global concierge out front, regional doorman in each building.
Is Azure Front Door a load balancer?
Yes. Front Door is a global layer-7 load balancer built on Microsoft's edge network, with over 100 points of presence. It catches requests at the point closest to the user, accelerates them across Microsoft's private backbone, and load-balances across origins in different regions, failing over if one region goes dark.
Does Application Gateway work across multiple regions?
No. Application Gateway is a regional service that lives inside a single virtual network in one region, in front of the backends there. It has no visibility into other regions. If you need to route traffic across multiple regions, you need Front Door in front of the regional gateways.
Is Azure Front Door a CDN?
Front Door includes CDN functionality: Microsoft describes it as an advanced content delivery network for the cloud. It caches static content near the user, terminates TLS at the edge, and runs a WAF at the edge, in addition to its load-balancing and cross-region failover role.