Azure Front Door

Azure Front Door Skill

Manage and analyze Azure Front Door using az afd (Standard/Premium) and az network front-door (Classic) commands.

Discovery-First Rule

ALWAYS discover before acting. Never assume profile names, endpoint names, origin group names, or WAF policy names.

# Discover Front Door Standard/Premium profiles
az afd profile list --output json \
  --query "[].{name:name, rg:resourceGroup, sku:sku.name, provisioningState:provisioningState, enabledState:enabledState}"

# Discover Classic Front Doors
az network front-door list --output json \
  --query "[].{name:name, rg:resourceGroup, enabledState:enabledState, frontendEndpoints:frontendEndpoints[].hostName}"

Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

for profile in $(echo "$profiles" | jq -c '.[]'); do
  {
    name=$(echo "$profile" | jq -r '.name')
    rg=$(echo "$profile" | jq -r '.rg')
    az afd endpoint list --profile-name "$name" --resource-group "$rg" --output json
  } &
done
wait

Helper Functions

# List endpoints for a profile
list_endpoints() {
  local profile="$1" rg="$2"
  az afd endpoint list --profile-name "$profile" --resource-group "$rg" --output json \
    --query "[].{name:name, hostName:hostName, enabledState:enabledState, provisioningState:provisioningState}"
}

# List origin groups
list_origin_groups() {
  local profile="$1" rg="$2"
  az afd origin-group list --profile-name "$profile" --resource-group "$rg" --output json \
    --query "[].{name:name, healthProbe:healthProbeSettings, loadBalancing:loadBalancingSettings, sessionAffinity:sessionAffinityState}"
}

# List routes
list_routes() {
  local profile="$1" rg="$2" endpoint="$3"
  az afd route list --profile-name "$profile" --resource-group "$rg" --endpoint-name "$endpoint" --output json \
    --query "[].{name:name, patternsToMatch:patternsToMatch, originGroup:originGroup.id, enabledState:enabledState, forwardingProtocol:forwardingProtocol, httpsRedirect:httpsRedirect, cacheConfiguration:cacheConfiguration}"
}

# Get WAF policy
get_waf_policy() {
  local name="$1" rg="$2"
  az network front-door waf-policy show --name "$name" --resource-group "$rg" --output json \
    --query "{name:name, sku:sku.name, policySettings:policySettings, managedRules:managedRules.managedRuleSets[].{type:ruleSetType, version:ruleSetVersion}, customRules:customRules.rules[].{name:name, priority:priority, action:action, matchConditions:matchConditions}}"
}

Common Operations

1. Front Door Overview

profiles=$(az afd profile list --output json --query "[].{name:name, rg:resourceGroup}")
for p in $(echo "$profiles" | jq -c '.[]'); do
  {
    name=$(echo "$p" | jq -r '.name')
    rg=$(echo "$p" | jq -r '.rg')
    echo "=== Profile: $name ==="
    list_endpoints "$name" "$rg"
    list_origin_groups "$name" "$rg"
  } &
done
wait

2. Routing Rules Analysis

endpoints=$(list_endpoints "$PROFILE" "$RG")
for ep in $(echo "$endpoints" | jq -c '.[]'); do
  {
    ep_name=$(echo "$ep" | jq -r '.name')
    list_routes "$PROFILE" "$RG" "$ep_name"
  } &
done
wait

3. WAF Policy Review

# List WAF policies
az network front-door waf-policy list --resource-group "$RG" --output json \
  --query "[].{name:name, policyMode:policySettings.mode, enabledState:policySettings.enabledState, redirectUrl:policySettings.redirectUrl}"

# Get detailed rule configuration
get_waf_policy "$WAF_POLICY" "$RG"

# Check managed rule overrides
az network front-door waf-policy show --name "$WAF_POLICY" --resource-group "$RG" --output json \
  --query "managedRules.managedRuleSets[].ruleGroupOverrides[].{group:ruleGroupName, rules:rules[].{id:ruleId, action:action, enabledState:enabledState}}"

4. Health Probe Configuration

# Check origin group health probes
az afd origin-group list --profile-name "$PROFILE" --resource-group "$RG" --output json \
  --query "[].{name:name, probePath:healthProbeSettings.probePath, probeProtocol:healthProbeSettings.probeProtocol, probeIntervalSec:healthProbeSettings.probeIntervalInSeconds, probeMethod:healthProbeSettings.probeRequestType}"

# List origins with health status
for og in $(az afd origin-group list --profile-name "$PROFILE" --resource-group "$RG" --query "[].name" -o tsv); do
  {
    az afd origin list --profile-name "$PROFILE" --resource-group "$RG" --origin-group-name "$og" --output json \
      --query "[].{name:name, hostName:hostName, httpPort:httpPort, httpsPort:httpsPort, priority:priority, weight:weight, enabledState:enabledState}"
  } &
done
wait

5. Cache Configuration

# Check caching rules per route
endpoints=$(list_endpoints "$PROFILE" "$RG")
for ep in $(echo "$endpoints" | jq -c '.[]'); do
  {
    ep_name=$(echo "$ep" | jq -r '.name')
    az afd route list --profile-name "$PROFILE" --resource-group "$RG" --endpoint-name "$ep_name" --output json \
      --query "[].{route:name, cacheEnabled:cacheConfiguration.isCompressionEnabled, queryStringCaching:cacheConfiguration.queryStringCachingBehavior, cacheDuration:cacheConfiguration.cacheDuration}"
  } &
done
wait

Output Format

Present results as a structured report:

Azure Front Door Report
═══════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Anti-Hallucination Rules

1. NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
2. NEVER fabricate metric names or dimensions — verify against the service documentation or --help output.
3. NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
4. ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
5. ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.

Counter-Rationalizations

Common Pitfalls

1. Classic vs Standard/Premium: Classic uses az network front-door, Standard/Premium uses az afd. Commands are not interchangeable.
2. WAF mode: Detection mode logs but does not block. Prevention mode blocks. Check policySettings.mode before assuming protection is active.
3. Health probe overhead: HEAD probes are more efficient than GET. Frequent probes (every 5s) to slow backends can cause load. Check probe interval.
4. Custom domains: Custom domains require CNAME validation and certificate binding. Check domain validation state before troubleshooting routing.
5. Cache purge scope: Purging by URL pattern affects all edge nodes globally. Wildcard purge (/*) clears the entire cache -- use specific paths when possible.