Error for .bicep after migrating from Azure CDN (Classic) to Azure Front Door Standard

Hello @Buchczyk, Kornelia,

Hope you're doing well!

Thanks for reaching out to Microsoft Q&A. 

If you’ve moved from a Classic Azure CDN (like Verizon or Edgio) to Front Door Standard, but now your Bicep deployment fails, it’s probably because your template still has old resource types and settings. To fix this, follow these steps:

1. Export and Convert Your Template

• In the Azure portal, go to your Front Door Standard resource.
• Export the ARM template (JSON format).
• Use the Azure CLI to convert this JSON to Bicep with this command: This creates a Bicep file you can edit.

2. Update the Profile SKU

• Find the part in your Bicep file where you define the CDN profile.
• Change the SKU name to 'Standard_AzureFrontDoor'.
• This replaces the old SKUs from Classic CDN.

3. Replace Old Endpoints with Front Door Endpoints

• Remove any Microsoft.Cdn/profiles/endpoints sections for Classic CDN.
• Add a new resource for Front Door Standard endpoints (afdEndpoints) with the correct hostname.

4. Update Your Custom Domains

• Move your custom domain resources from under endpoints to be directly under the profile.
• Make sure the TLS settings are correct — usually “ManagedCertificate” and minimum TLS version 1.2.
• If you use Azure DNS for validation, include the DNS zone info.

5. Define Origin Groups and Routes

• Azure Front Door uses “origin groups” and “routes” instead of classic origins and rules.
• Create an origin group resource listing your backend endpoints.
• Create a route resource that points all traffic (like /*) to your origin group and the correct custom domains.

6. Check and Deploy Your Bicep File

• Run bicep build main.bicep --stdout to validate your code.
• Use az deployment group what-if to see what Azure will change before deploying.
• Finally, deploy with az deployment group create.

7. Final Steps After Deployment

• Update your DNS records so your domain points to the new Front Door endpoint (*.azurefd.net).
• Check your TLS certificates and settings to make sure they work with Front Door.
• Remove any leftover Classic CDN resources once everything is working.

In short: Your exported template still uses old CDN types. Switching those out for Front Door Standard resources like afdEndpoints, profile-level customDomains, originGroups, and routes and updating the SKU fixes the deployment errors and reflects your new setup correctly.

az bicep decompile --file template.json

Supporting Documents:

https://learn.microsoft.com/en-us/azure/frontdoor/post-migration-dev-ops-experience

I tried with exporting BICEP and ARM template + decompiling to BICEP. It gives the same result with using following resources:

• 'Microsoft.Cdn/profiles@2025-04-15'
• 'Microsoft.Cdn/profiles/afdendpoints@2025-04-15'
• 'Microsoft.Cdn/profiles/customdomains@2025-04-15'
• 'Microsoft.Cdn/profiles/origingroups@2025-04-15'
• 'Microsoft.Cdn/profiles/origingroups/origins@2025-04-15'
• 'Microsoft.Cdn/profiles/afdendpoints/routes@2025-04-15'

resource cdn 'Microsoft.Cdn/profiles@2025-04-15' = {
  name: cdnName
  location: 'global'
  sku: {
    name: 'Standard_AzureFrontDoor'
  }
  properties: {
    originResponseTimeoutSeconds: 30
  }
}

resource cdn_endpoint 'Microsoft.Cdn/profiles/afdendpoints@2025-04-15' = {
  parent: cdn
  name: cdnEndpointName
  location: location
  properties: {
    enabledState: 'Enabled'
  }
}

resource cdn_customDomain 'Microsoft.Cdn/profiles/customdomains@2025-04-15' = {
  parent: cdn
  name: '${cdnEndpointName}-Migrated'
  properties: {
    hostName: cdnEndpointDomainName
    tlsSettings: {
      certificateType: 'ManagedCertificate'
      minimumTlsVersion: 'TLS12'
      cipherSuiteSetType: 'TLS12_2022'
    }
  }
}

Unfortunately, it fails for customdomain resource with the same error

Hello @Buchczyk, Kornelia,

Hope you're doing well!

Thanks for sharing the details. Based on my analysis, the deployment is failing because the custom domain is still associated with your old CDN Classic profile. To get this working in Azure Front Door Standard, please follow the steps below:

1. Please remove the domain from CDN Classic. You can follow these steps to remove the custom domain from the portal.

• Open the Azure Portal and go to your Azure CDN (Classic) profile.
• Navigate to Custom domains and remove the affected domain.
• Wait around 30–60 minutes for the change to propagate (sometimes longer due to DigiCert processing).
• After the domain has been completely unbound, please try the Bicep deployment again using the updated format below.

2. I noticed that the custom domains are currently deployed under the profile, but they should be deployed under the endpoint. Please use the Bicep Template below, as Azure Front Door Standard requires custom domains to be set up this way.

Your current Bicep code:

resource afdCustomDomain 'Microsoft.Cdn/profiles/customDomains@2025-04-15' = {
  parent: cdn_endpoint
  name: '${cdnEndpointName}-Migrated'
  properties: {
    hostName: cdnEndpointDomainName
    tlsSettings: {
      certificateType: 'ManagedCertificate'
      minimumTlsVersion: 'TLS12'
      cipherSuiteSetType: 'TLS12_2022'
    }
  }
}

Update it to:

resource afdCustomDomain 'Microsoft.Cdn/profiles/afdendpoints/customDomains@2025-04-15' = {
  parent: cdn_endpoint
  name: '${cdnEndpointName}-Migrated'
  properties: {
    hostName: cdnEndpointDomainName
    tlsSettings: {
      certificateType: 'ManagedCertificate'
      minimumTlsVersion: 'TLS12'
      cipherSuiteSetType: 'TLS12_2022'
    }
  }
}

This ensures the domain is linked to the new AFD endpoint instead of the legacy CDN Classic profile.

3)Please make sure your DNS settings are updated so that the custom domain has a CNAME record pointing to your AFD endpoint hostname (e.g., yourdomain.com → afdendpoint.azurefd.net). This step is required for TLS/HTTPS certificate validation.

Supporting Documents:
https://learn.microsoft.com/en-us/azure/cdn/cdn-map-content-to-custom-domain?tabs=azure-dns%2Cazure-portal%2Cazure-portal-cleanup#remove-a-custom-domain

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain#validate-the-custom-domain

Could you kindly follow the steps outlined above and confirm if they resolve the issue or you need further assistance on this issue.