CDN to Front door migration fails validate test

Hello Jones, Martin {External~WARACLE LTD}

Based on the error message, it appears you are unable to migrate your CDN profile. This issue often happens if the certificate is missing from the custom domains. If the endpoint isn’t CNAMEd and the managed certificate doesn’t renew automatically, HTTPS will be disabled, blocking the migration.

Please check if the certificate is valid. If it is, migration will work until April 14, 2026. If you haven’t migrated by April 9, 2026 and are using a managed certificate, Microsoft will perform a forced migration.

You can also try deleting the endpoint, disabling HTTPS, and then re-enabling it for your endpoint.

Alternatively, consider creating a new Front Door profile (Standard or Premium), migrating your traffic, and testing it. This can help reduce downtime and prevent connection issues.

Or you can wait until April 14, when Microsoft will carry out the forced migration.

I hope the above answer helps you! Please let us know if you have any further questions.

Please don't forget to "upvote" where the information provided will help you, this can be beneficial to other members of the community.

Hello Jones, Martin {External~WARACLE LTD},

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your CDN to Front door migration fails validation test.

The validation failure is typically caused by endpoint name, route path, or custom-domain/HTTPS requirements that the migration checker enforces; I will appreciate if you can confirm the exact blocker by running Test-AzFrontDoorCdnProfileMigration and using Portal > Front Door (classic) > Settings > Migration > Validate > View errors Check this links Migrate—guide, Tier migration—overview, PowerShell validation cmdlet for more insights. Complete command to be certain of the issue is: Test-AzFrontDoorCdnProfileMigration -ResourceGroupName "<rg>" -SubscriptionId "<sub>" -FrontDoorId "<classic-frontdoor-resource-id>" PowerShell doc.

Fix them by renaming endpoints/cleaning duplicate route paths and ensuring all custom domains are validated with HTTPS, then re‑run the test; you can pre‑create a non‑conflicting endpoint: az afd endpoint create -g <rg> --profile-name <profile> --endpoint-name <uniqueName> --enabled-state Enabled --name-reuse-scope SubscriptionReuse - Endpoints, Configure endpoints & routes, Domains & validation. If validation still fails, manually recreate the AFD Standard/Premium profile (endpoints, routes, origins, rules), then update DNS CNAME to the hash endpoint to complete cutover - Migration guide, Migration FAQ—DNS update

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Hello,

Thanks for your reply.
The Migration → Validate → View errors in the portal contains no errors.
The az command line is also empty and tells me to contact Microsoft Support.
{

"canMigrate": false,

"defaultSku": "Standard_AzureFrontDoor",

"errors": [

{

  "code": "UnexpectedErrorOccurred",

  "errorMessage": "",

  "nextSteps": "Please contact support for migrating this frontdoor.",

  "resourceName": ""

}
```  ],

  "id": "/subscriptions/8xxxxxxx/resourcegroups/portal-uat/providers/Microsoft.Cdn/operationresults/e8fef3fe-8e6xxxxx6e/profileresults/rchdbmsdportaluatcdn/canmigrateresults/rchdbmsdportaluatcdn",

  "resourceGroup": "portal-uat",

  "type": "Microsoft.Cdn/canmigrate"

}  
Please let me know how to proceed.  
Thanks.