How to Configure Azure Front Door with custom domain and 2 app services as origins

Question

How to Configure Azure Front Door with custom domain and 2 app services as origins

Melisa Ramos 0

I am using Azure Front Door standard with a WAF security policy. I have a custom domain configured with the Front Door profile.

I want to use the same custom domain for my front door and app service origins. For example "lb.dv.org" for all 3 . User's image

Reference: https://learn.microsoft.com/en-us/azure/architecture/best-practices/host-name-preservation

I followed this documentation for the setup and it works with 1 App Service, but when I do the same thing for the second App Service, the load balancing doesn't work. It stays stuck on 1 App Service site.

I mainly want to keep the same custom domain for all 3 because I read this is best practice and in order to use the same WAF policy rules.

Any help on this issue would be greatly appreciated.

Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-06T09:03:41.8366667+00:00

Hello Melisa Ramos

Your approach of using a single custom domain with Azure Front Door and a WAF policy is a good practice, as it helps maintain host name consistency and centralized security. The challenge with load balancing across multiple App Services likely relates to routing and backend health settings.

To address this, consider the following steps:

Add all three App Services to one backend pool. Each should have a custom domain binding for lb.dv.org and use host name override to keep the custom domain intact.

Set up health probes for each backend. If a service fails the probe, Front Door will stop sending it traffic. Ensure the probe path returns a 200 OK status on all services.

Create a single routing rule that directs lb.dv.org to the backend pool, forwarding requests to all backends using round-robin or latency-based load balancing.

Please ensure SSL bindings exist for lb.dv.org on all App Services when using HTTPS.

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.
Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-07T15:09:54.89+00:00

Hello Melisa Ramos

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

If the above is unclear or you are unsure about something, please add a comment below.
Melisa Ramos 0 Reputation points

2025-08-08T19:10:52.8166667+00:00
I tried to implement this, but I had several issues. If I leave the 2 origins with the same priority and weight I get a 401 error / authentication loop.

If I set different priorities, the load balancer gets stuck on 1 app service and doesn't fall back to the 2nd. I stopped the App Service site to simulate failover.

I also tried leaving the host header empty and with the custom domain value. Both didn't work.

I am using the AFD managed certificate in Front Door and my own private certificate in App Services.

DNS records:

These are the doubts that I have:

should I leave the host header blank or use the custom domain value?

are there settings that I have to apply for Microsoft authentication to work together with AFD?

how can I verify that my private certificate is working?

Thank you in advance for your help !
Melisa Ramos 0 Reputation points

2025-08-11T13:43:28.4566667+00:00

I figured out what the issue was, I had to configure authentication settings and exclude the health probe path from authentication.

I followed this as a reference: https://azure.github.io/AppService/2021/03/26/Secure-resilient-site-with-custom-domain.html
Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-12T08:14:30.7433333+00:00

Hello Melisa Ramos

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

1 answer

Your answer

Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-06T09:03:41.8366667+00:00

Hello Melisa Ramos

Your approach of using a single custom domain with Azure Front Door and a WAF policy is a good practice, as it helps maintain host name consistency and centralized security. The challenge with load balancing across multiple App Services likely relates to routing and backend health settings.

To address this, consider the following steps:

Add all three App Services to one backend pool. Each should have a custom domain binding for lb.dv.org and use host name override to keep the custom domain intact.

Set up health probes for each backend. If a service fails the probe, Front Door will stop sending it traffic. Ensure the probe path returns a 200 OK status on all services.

Create a single routing rule that directs lb.dv.org to the backend pool, forwarding requests to all backends using round-robin or latency-based load balancing.

Please ensure SSL bindings exist for lb.dv.org on all App Services when using HTTPS.

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.
Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-07T15:09:54.89+00:00

Hello Melisa Ramos

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

If the above is unclear or you are unsure about something, please add a comment below.
Melisa Ramos 0 Reputation points

2025-08-08T19:10:52.8166667+00:00

I tried to implement this, but I had several issues. If I leave the 2 origins with the same priority and weight I get a 401 error / authentication loop.

If I set different priorities, the load balancer gets stuck on 1 app service and doesn't fall back to the 2nd. I stopped the App Service site to simulate failover.

I also tried leaving the host header empty and with the custom domain value. Both didn't work.

I am using the AFD managed certificate in Front Door and my own private certificate in App Services.

DNS records:

These are the doubts that I have:

should I leave the host header blank or use the custom domain value?

are there settings that I have to apply for Microsoft authentication to work together with AFD?

how can I verify that my private certificate is working?

Thank you in advance for your help !
Melisa Ramos 0 Reputation points

2025-08-11T13:43:28.4566667+00:00

I figured out what the issue was, I had to configure authentication settings and exclude the health probe path from authentication.

I followed this as a reference: https://azure.github.io/AppService/2021/03/26/Secure-resilient-site-with-custom-domain.html
Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-08-12T08:14:30.7433333+00:00

Hello Melisa Ramos

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 1

Hello Melisa Ramos

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution.

Please click "Accept" the answer as original posters help the community find answers faster by identifying the correct answer.

Issue: How to Configure Azure Front Door with custom domain and 2 app services as origins

Resolution: I figured out what the issue was, I had to configure authentication settings and exclude the health probe path from authentication.

I followed this as a reference: https://azure.github.io/AppService/2021/03/26/Secure-resilient-site-with-custom-domain.html

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members. Accepted answer

Share via

How to Configure Azure Front Door with custom domain and 2 app services as origins

1 answer

Your answer