MSDEVBUILD / azure

Load Balancer, Application Gateway and Front Door

Internet Office VNet 10.0.0.0/16 web subnet data subnet ✓NSG LOAD BAL. VNet 2 🗄️Storage (PaaS) Azure DNS A load balancer spreads traffic across healthy servers
A load balancer shares the work between healthy servers, so no single server gets overwhelmed.

😟 THE PROBLEM

One server gets all the traffic while others sit idle, and global users get slow pages.

😊 THE SOLUTION

Spread traffic with Load Balancer, Application Gateway or Front Door.

  • One server overloaded✓ Traffic spread across many
  • Different URLs need different servers✓ Application Gateway routes by path
  • Users far from the region✓ Front Door sends them to the nearest region
🛠️ Solved with: Load Balancer · App Gateway · Front Door
Module 2: Architecture & Services ⏱ 7 min read Updated 11 Nov 2026 Beyond the exam: real-world knowledge

Quick answer

All three spread traffic across servers, at different layers. Azure Load Balancer works at layer 4 (TCP/UDP) within a region. Application Gateway is a regional layer-7 web load balancer with URL-based routing, TLS termination and an optional Web Application Firewall. Azure Front Door is a global layer-7 entry point that routes users to the nearest healthy region, with caching and WAF.

Start with a question

Your shop has customers in Europe and Asia and ten servers. Who decides which server answers each customer?

A load balancer. Azure has several, each for a different kind of job.

Explain it like I’m 10

The technical explanation

Load Balancer

  • Layer 4 (TCP/UDP)
  • Regional
  • Public or internal
  • Very high performance

Application Gateway

  • Layer 7 (HTTP/S)
  • Regional
  • URL routing, TLS termination
  • Optional WAF

Front Door

  • Layer 7, global
  • Nearest healthy region
  • Caching at the edge
  • WAF, DDoS protection
Three ways to distribute traffic

Real-world business scenario

E-commerce

A global travel booking site

The problem
Users in Asia had slow pages and a regional outage took the site down worldwide.
What they used
Azure Front Door in front of App Service in two regions, with WAF enabled.
Why that choice
Global routing to the nearest healthy region plus edge security.
The result
Faster pages in Asia and automatic failover during a later regional incident.

When to use it and when not to

✓ Use it when…

  • **Load Balancer** for TCP/UDP and VM tiers.
  • **Application Gateway** for regional web apps with path routing or WAF.
  • **Front Door** for global web apps.

✕ Think twice when…

  • Front Door for purely internal, non-HTTP traffic.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What does a load balancer do?

Model answer

It spreads incoming traffic across several servers and stops sending traffic to any server that fails a health check, so the app stays fast and available.

Intermediate How do you choose between Load Balancer, Application Gateway and Front Door?

Model answer

Load Balancer for non-HTTP or high-performance layer-4 traffic in one region. Application Gateway for web apps in one region needing URL routing, TLS offload or WAF. Front Door for global web apps that need users routed to the closest healthy region, with caching and WAF at the edge.

Experienced developer Would you ever combine them?

Model answer

Yes. A common pattern is Front Door globally, routing to Application Gateway or directly to App Service in each region, with internal Load Balancers in front of VM-based back-end tiers. Front Door handles global failover; regional services handle local distribution.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which service is a regional layer-7 web load balancer with URL-based routing and an optional Web Application Firewall?

Question 2

Question 2 of 3

Users worldwide should be routed to the nearest healthy region of a web app. Which service fits best?

Question 3

Question 3 of 3

Which service distributes TCP and UDP traffic across VMs within a region?

Quick revision

Key points

  • Load Balancer = layer 4, regional, TCP/UDP.
  • Application Gateway = layer 7, regional, URL routing, TLS, WAF.
  • Front Door = layer 7, global, nearest healthy region, caching, WAF.
  • All use health probes to avoid unhealthy backends.

Important terminology

Layer 4
Transport layer (TCP/UDP). Routing by IP address and port only.
Layer 7
Application layer (HTTP/HTTPS). Routing can use URLs, headers and cookies.
Web Application Firewall (WAF)
Protects web apps from common attacks such as SQL injection and cross-site scripting.
Health probe
A regular check that removes unhealthy backends from rotation.

Common mistakes

  • Using Load Balancer when you need URL-based routing.

Exam tips

  • These are not listed in the current AZ-900 outline but are common in interviews and real projects.

Five quick revision questions

  1. 1.Which works at layer 4?Show

    Azure Load Balancer.

  2. 2.Which offers URL-based routing in one region?Show

    Application Gateway.

  3. 3.Which routes users globally to the nearest healthy region?Show

    Azure Front Door.

  4. 4.What protects web apps from SQL injection?Show

    A Web Application Firewall (WAF).

  5. 5.What removes failed servers from rotation?Show

    Health probes.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure Virtual WAN