Website · Documentation · Pricing

Cost calculator

Your traffic

Choose a workload. We’ll estimate traffic and requests for you.

Estimated monthly costs

USD per month, before tax. Load balancing and unpriced extras are excluded.

What’s included?

Estimates cover cacheable content. Origin and optional services are added only when you enter their rates. Plans differ in features and coverage; check their terms before buying.

Advanced settings
Split traffic between regions

Percentages must total 100%. The same split applies to bytes and requests. CloudFront charges by serving edge location; this is an approximation. Shared free allowances are allocated proportionally.

Origin and optional services

Paid tiers start with this workload; estimates do not include other account traffic. Enter your own effective rates after origin allowances. Reads use request misses; egress uses byte fill. Functions assume one invocation per viewer request. Zero leaves an extra out of the estimate; it does not mean your origin is free.

Compare a quote you received

This is your quote, not a published provider price. Use an effective rate for the selected traffic mix; tiers, included usage and commitments need to be reflected in your inputs. Sharing a scenario includes your quote details.

Presets are starting assumptions, not measured traffic. Video assumes one rendition and segment GETs; playlists, retries and extra audio tracks add requests. Fill is a byte ratio, not a request cache-hit rate. GB = 1 billion bytes; Google bills GiB = 1,073,741,824 bytes; CloudFront estimates use binary GB as a billing assumption.

Overview

Azure Front Door combines global application routing with static and dynamic content delivery. New deployments use Standard or Premium.

  • Standard: delivery, routing and custom WAF rules.
  • Premium: adds managed WAF rules, bot protection and Private Link origins.

The older services have separate retirement schedules: Front Door classic on March 31, 2027, and Azure CDN Standard from Microsoft classic on September 30, 2027. New profile/domain onboarding is closed, and classic managed certificates have already retired. Verify migration and certificate state for an existing classic workload.

Network

Microsoft publishes 192 Front Door edge locations across 109 commercial metros. A metro can contain several PoPs; the map marks approximate centers for resolved names in the published list.

Azure Government locations are separate and excluded from this map. Front Door uses unicast DNS routing and Microsoft’s backbone. Azure cloud regions are not interchangeable with delivery PoPs, and the resource-group location does not confine delivery to that region.

Published Front Door PoP metros

Approximate metro centers; a metro may contain several PoPs. Azure Government locations are excluded.

MontrealVancouverQuerétaroAtlantaCheyenneChicagoDallasDes MoinesDetroitHonoluluHoustonJacksonvilleLas VegasLos AngelesMemphisMiamiMinneapolisNashvilleNewarkNew YorkPhiladelphiaPhoenixPortlandSan AntonioSan JoseSalt Lake CitySeattleBuenos AiresCampinasRio de JaneiroSao PauloBogotaSofiaPragueParisBerlinDuesseldorfFrankfurtMunichAthensBudapestDublinMilanRomeAmsterdamOsloStavangerWarsawLisbonBucharestBarcelonaMadridZurichLondonManchesterCairoNairobiRabatLagosCape TownTel AvivDohaIstanbulDubaiChennaiHyderabadMumbaiNew DelhiHong KongJakartaOsakaTokyoSeoulKuala LumpurManilaSingaporeTaipeiBangkokHo Chi Minh CityBrisbaneMelbournePerthSydneyAuckland
Cities

Montreal, Vancouver, Querétaro, Atlanta, Cheyenne, Chicago, Dallas, Des Moines, Detroit, Honolulu, Houston, Jacksonville, Las Vegas, Los Angeles, Memphis, Miami, Minneapolis, Nashville, Newark, New York, Philadelphia, Phoenix, Portland, San Antonio, San Jose, Salt Lake City, Seattle, Buenos Aires, Campinas, Rio de Janeiro, Sao Paulo, Bogota, Sofia, Prague, Paris, Berlin, Duesseldorf, Frankfurt, Munich, Athens, Budapest, Dublin, Milan, Rome, Amsterdam, Oslo, Stavanger, Warsaw, Lisbon, Bucharest, Barcelona, Madrid, Zurich, London, Manchester, Cairo, Nairobi, Rabat, Lagos, Cape Town, Tel Aviv, Doha, Istanbul, Dubai, Chennai, Hyderabad, Mumbai, New Delhi, Hong Kong, Jakarta, Osaka, Tokyo, Seoul, Kuala Lumpur, Manila, Singapore, Taipei, Bangkok, Ho Chi Minh City, Brisbane, Melbourne, Perth, Sydney, Auckland

Listed without a marker: Etobicoke, Canada, Boydton, VA, USA, Chaska, MN, USA, Englewood, CO, USA, Manassas, VA, USA, Needham Heights, MA, USA, Plano, TX, USA, Quincy, WA, USA, Secaucus, NJ, USA, Southfield, MI, USA, Tempe, AZ, USA, Zaventem, Belgium, Ballerup, Denmark, Vantaa, Finland, Les Ulis, France, Saint Denis, France, Russelsheim, Germany, Bromma, Sweden, Isando, South Africa, Chai Wan, Hong Kong SAR, Inzai, Japan.

Features

FeatureSupported
Web application firewall✓ Supported
Bot protection◐ Partial
DDoS protection✓ Supported
Rate limiting✓ Supported
HTTP/3 (QUIC)Not listed
TLS 1.3✓ Supported
Tiered cachingNot listed
Origin shieldNot listed
Instant cache purge◐ Partial
Serve stale while refreshingNot listed
Serve stale on origin errors◐ Partial
Image optimizationNot listed
On-demand video✓ Supported
Live video✓ Supported
Digital rights managementNot listed
HLS / DASH packagingNot listed
WebSockets✓ Supported
Signed URLs✗ Not supported
Edge compute◐ Partial
Edge functions◐ Partial
Key-value storageNot listed
Configuration API✓ Supported
Real-time logs◐ Partial
Log export✓ Supported
Terraform provider✓ Supported

✓ Supported · Partial: limited or separate-product support · ✗ Not supported · Not listed: unconfirmed. Some features need a separate product or plan.

Delivery and security

  • Configure caching, compression, redirects, rewrites and origin routing.
  • Use TLS 1.3 and WebSockets on the current Front Door tiers.
  • Apply custom WAF rules and rate limits; managed rules and bot protection require Premium.

Purge completion can take ten minutes, and configuration changes can take fifteen. Rate limits use distributed counters and fixed windows; small thresholds can be exceeded.

Edge Actions preview

Run custom JavaScript on client requests for tasks such as JWT checks, URL rewrites and origin selection. The preview limits code to 16 KB and execution to 10 ms. If execution exceeds the limit, Front Door forwards the request without Edge Action processing; an authorization design must account for that behavior.

Media, cache and logs

Front Door delivers already prepared live/VOD manifests and segments. Encoding, packaging and DRM license services belong in the upstream media pipeline. Native cryptographic URL signing is not available in production; middleware token validation is separate.

Stale responses may be served during origin errors, but cache retention is not guaranteed. Enable diagnostics for access, WAF and probe logs; processing and storage can take a few minutes. HTTP/3 and controlled stale-while-revalidate support are unconfirmed.

Pricing

Front Door Standard and Premium

ChargeStandardPremium
Base fee, monthly equivalentUSD 35USD 330
First 10 TB, North America/EuropeUSD 0.083/GBUSD 0.083/GB
First 250 million requests, North America/EuropeUSD 0.009/10,000USD 0.015/10,000

The base fee is billed hourly per profile. Other delivery zones have different rates, and transfer tiers above 150 TB or requests above 250 million require a quote. Edge Actions and CAPTCHA have additional usage charges.

Advanced → Add your quote accepts confirmed delivery, request and monthly rates. Include the tier’s base fee as a monthly charge. Edge-to-origin request bytes are a separate meter: they are not the cache-fill response bytes used by this calculator. Add their expected cost under monthly extras. Origin response transfer into Front Door is nonbillable, but origin-side and monitoring costs may remain.

The retiring classic tiers have separate tariffs. Confirm the selected tier and Azure offer when preparing the budget.

Developer tools

  • Manage Front Door using Azure Resource Manager APIs, the portal, Azure CLI or PowerShell.
  • Use the documented Terraform resources for profiles, endpoints, origin groups, origins and routes.
  • Integrate Azure or external HTTP origins; Premium supports eligible Private Link origins.
  • Route opt-in diagnostic logs to storage, Event Hubs or Log Analytics.

For a classic migration, test domains, certificates, routes, cache settings, WAF and origin access before changing DNS. The Standard/Premium security and pricing models differ from the retired or retiring tiers.

When it fits

  • Applications using Azure or other public HTTP origins that need global routing and caching.
  • Teams that can select Standard or Premium around the required WAF and private-origin capabilities.
  • Prepared live/VOD media delivery with an upstream encoder and packager.
  • Operations using Azure deployment automation and diagnostic tooling.

Before you choose

  • New deployments planned around the retiring classic tiers.
  • Workflows requiring a zero-delay purge or immediate complete logs.
  • Applications that treat the Edge Actions preview as a fail-closed authorization boundary without a backup check.
  • Media pipelines expecting Front Door to encode, package or natively sign every stream URL.
  • Estimates that omit the per-profile base fee, request charges or edge-to-origin traffic meter.
Sources