Front Door vs Application Gateway: global edge vs regional layer 7
Both are layer-7. Both route by URL. Both bolt on a web application firewall. So people treat them as interchangeable — and pick wrong. The difference is one word: where. One lives inside a single region; the other lives at Microsoft's global edge.
Azure has a shelf of things that sit in front of your web app, and two of them look almost identical on the feature list: Application Gateway and Front Door. Both understand HTTP, both route on URL paths and host headers, both can run a WAF, both terminate TLS. If you compare them by bullet points you will conclude they are twins. They are not — they operate at completely different altitudes, and knowing which altitude your problem lives at is the whole decision.
Application Gateway: the regional doorman
Microsoft's definition is plain: Application Gateway is "a web traffic load balancer that helps you manage traffic to your web applications," making "intelligent routing decisions based on HTTP request attributes like URL paths and host headers." It operates at OSI layer 7, and — this is the key word — it is regional. It lives inside a virtual network, in one region, in front of the backends in that region.
Its job is to take traffic that has already arrived at your region and distribute it intelligently among your servers: send /images to one pool and /video to another, terminate TLS, run a WAF, autoscale, spread across availability zones. Think of it as the doorman inside one building, deciding which floor each visitor goes to. It is excellent at that — and it has no idea that your building might have a twin on another continent.
Front Door: the global edge
Front Door plays a bigger geography. Microsoft describes it as "an advanced content delivery network (CDN) for the cloud," using Microsoft's "extensive global edge network" of 100-plus points of presence positioned close to users worldwide. It is global, and it sits at the edge — the first Microsoft thing a user's request touches, wherever on earth that user is.
From that edge it does things a regional gateway structurally cannot: catch the request at the nearest point of presence (anycast), accelerate it across Microsoft's private backbone (split TCP), cache static content near the user (CDN), terminate TLS at the edge, run a WAF at the edge, and load-balance across origins in different regions — failing traffic over to a healthy region if one goes dark. Front Door is not the doorman inside one building; it is the global concierge network deciding which building — which region — each user should be sent to in the first place.
Application Gateway spreads traffic across servers in a region. Front Door spreads traffic across regions, at the edge, near the user.
| Application Gateway | Front Door | |
|---|---|---|
| Reach | Regional (one region / VNet) | Global (Microsoft edge) |
| Layer | Layer 7 (HTTP/S) | Layer 7 (HTTP/S) at the edge |
| Load-balances across | Servers within a region | Origins across regions |
| CDN caching | No | Yes |
| WAF | Yes (regional) | Yes (at the edge) |
| URL / host routing | Yes | Yes |
| Lives in your VNet | Yes | No — it is a global service |
So which do you choose?
- One region, routing traffic among backends? Application Gateway. If your app runs in a single region and you need layer-7 routing, TLS termination, and a WAF in front of the servers there, the regional doorman is exactly right — and simpler.
- Global audience, multiple regions, or you want edge caching and acceleration? Front Door. If users are worldwide, or you run in more than one region and want automatic failover between them, you need something that lives at the edge and thinks in continents.
The grown-up pattern for a large global app uses both: Front Door at the global edge for caching, acceleration, and cross-region routing, with an Application Gateway inside each region doing fine-grained layer-7 routing to the servers there. Global concierge out front, regional doorman in each building. Naming that combination in an interview signals you understand the altitudes rather than memorising a feature list.
The one line to remember
When two services share a feature list, stop comparing features and compare scope. Application Gateway is regional; Front Door is global. Every other difference — the CDN, the anycast, the cross-region failover — falls out of that single fact. Ask where your traffic problem lives, at the edge or inside a region, and the choice makes itself.