API Management, Front Door, Application Gateway, Load Balancer, and Traffic Manager

Azure traffic services operate at different layers. Front Door is a global HTTP edge and acceleration service. Application Gateway is a regional layer-7 load balancer and WAF. Load Balancer distributes layer-4 TCP/UDP traffic. Traffic Manager makes DNS-based routing decisions. API Management publishes, secures, transforms, governs, and observes APIs.

Which service solves which problem?

They can be combined. A global application might use Front Door → regional Application Gateway or API Management → private apps. Avoid stacking products without a requirement; each adds cost, latency, limits, certificates, logs, and failure modes.

How do you configure API Management?

Ways to build

Choose the Azure tool you want to use. The underlying resource stays the same.

Azure portalAzure CLI

Azure portal

Search API Management services → Create. Choose a tier from current guidance; developer tiers are not production SLAs. Import an OpenAPI document, define a backend, apply policies, create products, protect subscriptions, configure Entra/OAuth, and publish through a controlled gateway hostname.

Useful policies include:

• JWT validation.
• Rate limit and quota.
• Backend routing and retry with care.
• Header normalization and correlation IDs.
• Caching for safe responses.
• Request/response transformation.

Do not use a policy to hide a fundamentally broken API contract. Store named secrets in Key Vault integrations where supported.

Azure CLI

Create the service with placeholders, then use the current az apim api import and policy commands or an IaC template for the reviewed API definition:

bash

WrapCopy

az apim create \ --resource-group "$AZURE_RG" \ --name "apim-northstar-REPLACE_UNIQUE" \ --location "$AZURE_LOCATION" \ --publisher-name "Northstar Team" \ --publisher-email "REPLACE_WITH_TEAM_ALIAS" \ --sku-name Developer

This service can take time to provision and can be expensive. Delete learning instances promptly.

How do global and regional health checks differ?

Front Door health probes determine origin health from the global edge. Application Gateway probes regional backends. Load Balancer probes ports/endpoints. Traffic Manager checks public endpoints before returning DNS answers. DNS clients cache answers, so Traffic Manager failover is not an instant connection switch.

A health endpoint should report whether the instance can serve traffic, but avoid making it so strict that a minor dependency removes every instance simultaneously.

What is the safe WAF path?

1. Deploy WAF in detection mode.
2. Send logs to a monitored destination.
3. Observe false positives with real traffic.
4. Tune exclusions narrowly.
5. Move managed rules to prevention mode.
6. Add rate limits/bot controls based on threat and product tier.

WAF does not replace secure code, API authorization, DDoS design, or host protections.

How do IaC and certificates fit?

Bicep/Terraform should declare profiles/gateways, origins/backends, routes/listeners, health probes, WAF policy, custom domains, managed or Key Vault certificates, identities, private links, diagnostics, and alerts. Separate DNS delegation/validation steps may require cross-team coordination.

Use certificate automation and expiry alerts. Never paste a private key into a template. Validate host headers and origin certificates end to end.

Decision checklist

• Is traffic HTTP(S), TCP/UDP, or DNS-routed?
• Is the entry point global or regional?
• Must the origin be private?
• Do you need API products/policies or only routing?
• What failover time and session behavior are required?
• Where is TLS terminated and re-encrypted?
• Which layer emits access, WAF, and health logs?
• What is the cost at expected requests and data transfer?

Official references

• Azure Front Door
• Application Gateway
• Azure Load Balancer
• Traffic Manager
• API Management