azure
A multi-region design is only as good as the thing that steers traffic between the regions. On Azure that thing is one of two global routers, and picking the wrong one leaves you with failover that is either slow or does not fire at all. Front Door and Traffic Manager solve overlapping problems in very different ways, so this guide is about matching the router to the workload and, when it helps, combining them.
Two different mechanisms
The single most important distinction is how each service routes.
- Azure Traffic Manager works at DNS. When a client resolves your name, Traffic Manager returns the address of a healthy endpoint. It is protocol-agnostic and can front anything with an address, but its failover is bounded by DNS TTL: clients keep hitting the cached primary until the TTL expires.
- Azure Front Door works at layer 7 over anycast. Clients connect to the nearest Microsoft edge, which terminates TLS and forwards to a healthy backend. Failover changes only the backend selection, so it happens in seconds without waiting on client caches, and it adds caching and a web application firewall along the way.
When to use which
| Need | Front Door | Traffic Manager |
|---|---|---|
| HTTP/HTTPS web app or API | Yes, preferred | Works, but slower failover |
| Non-HTTP protocol | No | Yes |
| TLS offload, caching, WAF at the edge | Yes | No |
| Fastest, cache-independent failover | Yes | No |
| Route across other Front Door profiles | Combine with TM | Yes |
For a public web app or API that needs regional failover, reach for Front Door. Its anycast model is what makes failover fast enough to hit an aggressive RTO. Keep Traffic Manager for non-HTTP endpoints, or as a DNS tier above Front Door in the layered pattern below.
Health probes are where teams get burned
Both services fail over based on health probes, and the common mistake is the same in both:
probing a static page. A /health file that returns 200 while the region's database is down keeps
the router sending traffic into a broken region. Point the probe at a path that touches a real
dependency, then tune the interval and failure threshold so failover is prompt without flapping
on a single transient blip. This is the routing half of the topology described in
multi-region failover; the probe is the sensor that makes the
whole thing react.
Routing methods
Match the method to the objective from your continuity tiers:
- Priority (failover). All traffic to the primary; drop to the next endpoint only when the primary is unhealthy. This is active-passive.
- Weighted. Split traffic by ratio across regions. Useful for active-active and for canary rollouts.
- Latency / performance. Send each user to the lowest-latency healthy region. Active-active with a locality bias.
- Geographic. Route by the user's location, which matters when data residency or compliance dictates where a request must land.
Layering both
Sometimes one router cannot express what you need. Traffic Manager can sit above Front Door, distributing across multiple Front Door profiles or across Front Door plus a non-HTTP endpoint. It buys you a DNS-level tier on top of the anycast tier, at the cost of more moving parts. Use it only when a single service genuinely falls short, not by default.
Test the failover for real
Configuration that has never failed over is untested. Force a failover, either by disabling the primary endpoint or failing its probe on purpose, and confirm traffic moves to the secondary inside your expected window. With Traffic Manager, measure the extra time DNS caching adds, because that is part of your real RTO whether you like it or not.
Where this fits
Global routing is the visible tip of a resilience design that runs deeper than the router. Pair it with the multi-region failover topology and business continuity planning, and add outage alerts so you know a region is degrading before your probes have finished deciding. Track cross-provider outage history at clouddowntime.com/data, recover SLA credits when a Microsoft outage breaches its terms at cloudslacredit.com, and let nextsignal.io watch your bill for both outage credits and silent billing drift.