Start with protocol and geographic scope
Standard Load Balancer
Layer 4 distribution of TCP and UDP flows to VMs or scale sets. Use public or internal frontends for high-throughput, low-latency regional network traffic.
Application Gateway
Regional Layer 7 web traffic proxy with host- and path-based routing, TLS termination, autoscaling, health probes and optional Web Application Firewall.
Azure Front Door
Global edge application delivery for public HTTP and HTTPS. It accelerates static and dynamic content, routes among origins, supports caching, TLS and WAF, and uses Microsoft’s global network.
Scenario-based choices
Private SQL listener across backend VMs
The application requires internal TCP distribution inside a virtual network. Choose an internal Standard Load Balancer. Application Gateway and Front Door are designed around application-layer web delivery, not a private generic TCP listener for this scenario.
One regional web application with URL routing and WAF
Requests to /images and /api must reach separate backend pools, and the service needs web-application protection. Choose Application Gateway with listener rules, backend settings, custom health probes and WAF policy.
Global website with origins in several regions
Users should enter through a nearby edge location, static content should be cached, and unhealthy origins should be removed quickly. Choose Azure Front Door and configure origin groups, health probes, routes, domains, TLS and WAF as required.
Global and regional layers can work together
Do not combine services automatically. Each extra hop adds configuration, monitoring and cost. Use both only when the workload genuinely needs global edge capabilities and regional application-delivery controls.
Current platform note: Basic Load Balancer was retired on September 30, 2025. Use Standard Load Balancer for current Layer 4 designs, and remember that Standard public IPs and load balancers require explicit NSG permission for inbound traffic.
Real-world troubleshooting sequence
- Scope and protocol: confirm public versus private, regional versus global, and TCP/UDP versus HTTP/HTTPS.
- Frontend: verify public IP or private IP, listener, domain, certificate and port.
- Routing: inspect load-balancing rules, Application Gateway rule priority, or Front Door routes and origin groups.
- Health: examine probe protocol, host header, path, expected status and backend response.
- Network controls: validate NSGs, user-defined routes, Azure Firewall and return paths.
- Backend identity: confirm pool membership, address resolution and the application’s listening port.
Fast AZ-104 decision rule
TCP/UDP and VM flows: Standard Load Balancer. Regional web routing, TLS and WAF: Application Gateway. Global public web acceleration, origin routing and edge security: Azure Front Door.
Official Microsoft references
Frequently asked questions
What is the main difference between Azure Load Balancer and Application Gateway?
Azure Load Balancer distributes TCP and UDP flows at Layer 4. Application Gateway is a regional application-delivery proxy that makes Layer 7 decisions using HTTP attributes such as URL paths and host headers.
When should I choose Azure Front Door?
Choose Front Door for globally distributed internet-facing HTTP and HTTPS applications that need edge acceleration, global origin routing, rapid health-based failover, caching, TLS termination and optional WAF protection.
Can Front Door and Application Gateway be used together?
Yes. Front Door can provide the global edge entry point while regional Application Gateways provide regional Layer 7 routing, private backend integration and WAF controls where the architecture requires both layers.
Is Azure Basic Load Balancer still available for new designs?
Basic Load Balancer was retired on September 30, 2025. Current designs should use Standard Load Balancer and its explicit Network Security Group access model.