Azure load balancing options compared
Azure has four load balancing services that exam questions mix freely: Load Balancer (layer 4, regional), Application Gateway (layer 7, regional), Front Door (layer 7, global) and Traffic Manager (DNS-based, global). The decision rule is two questions: is the traffic HTTP(S) that needs URL, host or WAF decisions, and does it need to span regions? Non-HTTP and regional gives Load Balancer, HTTP and regional gives Application Gateway, HTTP and global gives Front Door, and non-HTTP or DNS-only and global gives Traffic Manager.
Three questions, in this order
1. What is being balanced: raw TCP/UDP, or web requests? Load Balancer works at layer 4 and handles any TCP or UDP protocol, public or internal. Application Gateway and Front Door work at layer 7: they read the HTTP request and can route on URL path or host header, terminate TLS, and add a web application firewall (WAF). Microsoft’s own definition of a “web application” for this decision is one that needs at least one of: a layer 7 routing decision such as a URL path, inspection of the request body, or TLS handling.
2. One region or many? Load Balancer and Application Gateway are regional: they sit in a virtual network and spread traffic over VMs, scale sets or other back ends in that region. Front Door and Traffic Manager are global: they sit in front of regional deployments and choose a region. Microsoft notes that a regional service can technically front back ends in several regions, but that makes one region a single point of failure and adds latency.
3. Does the service carry the traffic, or just point at it? Traffic Manager only answers DNS queries. The client then connects straight to the chosen endpoint, so Traffic Manager never sees the traffic, cannot cache, inspect or terminate TLS, and cannot fail over faster than DNS caching and TTLs allow. Front Door is a proxy at the edge: the client connects to Front Door, which connects to the back end. That is why Microsoft describes Traffic Manager as unable to fail over as quickly as Front Door.
The comparison table
| Load Balancer | Application Gateway | Front Door | Traffic Manager | |
|---|---|---|---|---|
| Layer | 4 (TCP, UDP) | 7 (also TCP/TLS proxy) | 7 | DNS |
| Scope | Regional (plus a cross-region tier) | Regional | Global | Global |
| Carries the traffic | Yes, pass-through | Yes, terminating proxy | Yes, terminating proxy | No, DNS answer only |
| WAF | No | Yes | Yes | No |
| URL path routing, TLS offload | No | Yes | Yes | No |
| Caching and acceleration | No | No | Yes | No |
| Back ends | VMs, scale sets | Web back ends, including AKS through an ingress controller | Web origins | Any internet-facing endpoint, including outside Azure |
| Lives in your VNet | Frontend yes (internal) | Dedicated subnet | No | No |
Two details deserve attention. Standard Load Balancer is closed to inbound traffic until a network security group allows it, and the Basic SKU was retired on 30 September 2025, so any answer relying on Basic is stale. An application gateway needs a dedicated subnet that can hold other application gateways but no other resources, and its v1 SKUs were retired on 28 April 2026, so current designs mean v2 (Standard_v2 or WAF_v2).
Worked example: a shop in two regions
A retailer runs its web shop on VMs in West Europe and North Europe. Requirements: users go to the nearest healthy region, /api/* goes to a different pool than the rest, a WAF is mandatory, and a second internal tier (SQL on VMs) needs balancing on TCP 1433.
- Choose the region: Front Door (global, layer 7, fast failover, WAF). Traffic Manager would route correctly but cannot do WAF or path rules and is slowed by DNS caching.
- Inside each region, send
/api/*and/to different pools: Application Gateway (WAF_v2) in each region, behind Front Door. Microsoft documents deploying Application Gateway behind Front Door as a normal pattern when regional layer 7 processing is needed. - The SQL tier: an internal Standard Load Balancer, because it is TCP, not HTTP, and stays inside the VNet.
Result: three services, each doing the part it is designed for. The Azure Architecture Center says explicitly that an effective design often uses more than one, and that each workload service should be assessed individually.
Which exams test this
| Exam | How it appears | Covered on this site |
|---|---|---|
| AZ-104 | Implement and manage virtual networking: configure an internal or public load balancer and troubleshoot load balancing. The outline names Azure Load Balancer only, not the layer 7 or global services | Virtual networking |
| AZ-305 | Design infrastructure solutions: recommend a load-balancing and routing solution, which means choosing among all four services by layer, scope and WAF need | Infrastructure solutions |
| AZ-305 | Design business continuity solutions: recommend a high availability solution for compute, where a global load balancer in front of several regions is one option. An indirect use of the topic | Business continuity |
AZ-104 asks for configuration of Azure Load Balancer; AZ-305 asks for selection across the services.
How questions are built
The trap is picking by familiarity. Trigger words that decide the answer:
- “HTTP”, “URL path”, “host header”, “TLS termination”, “WAF”: Application Gateway (one region) or Front Door (multiple regions).
- “Any TCP or UDP”, “non-HTTP”, “internal”, “VMs in a scale set”: Load Balancer.
- “DNS”, “on-premises endpoint”, “lowest latency routing” with no mention of caching or WAF: Traffic Manager.
- “Global”, “caching”, “fastest failover”, “edge”: Front Door.
- “Across availability zones”: Standard Load Balancer or v2 Application Gateway, both zone redundant; see availability sets vs zones.
Application Gateway and the WAF also appear in comparisons with Azure Firewall, NSG and WAF, and the packet filtering that must allow a load balancer in is explained in NSG rule evaluation. Back ends are chosen in choosing an Azure compute service.
Practice questions
Question 1. A company hosts a public website in two Azure regions. Users must be routed to the closest healthy region, the site needs a web application firewall, and failover should be as fast as possible without waiting for DNS caches to expire. Which service should be placed in front of the regional deployments?
- A. Azure Traffic Manager
- B. Azure Application Gateway
- C. Azure Front Door
- D. Azure Load Balancer
Show answer
Answer: C
Azure Front Door is a global layer 7 proxy with WAF and fast failover, because clients connect to it rather than being redirected by DNS. Traffic Manager only answers DNS queries, has no WAF and is delayed by DNS caching and TTLs. Application Gateway is regional, so using it as the global entry point creates a single point of failure. Load Balancer is layer 4 and has no WAF.
Question 2. Two VMs run a custom TCP service on port 5000 inside a virtual network. Only other VMs in the same network connect to it, and traffic must be spread across both VMs. Which resource should you deploy?
- A. An internal Standard Load Balancer
- B. A public Application Gateway
- C. Azure Front Door
- D. A Traffic Manager profile
Show answer
Answer: A
An internal Standard Load Balancer balances any TCP or UDP traffic across VMs using a private frontend IP, which matches a non-HTTP service reached only from inside the network. Application Gateway is for HTTP(S) and needs its own subnet. Front Door and Traffic Manager are global services for public endpoints and do not balance private VM traffic inside a virtual network.
Go deeper
- Load balancing options (Azure Architecture Center, includes the decision tree)
- What is Azure Load Balancer?
- What is Azure Application Gateway?
- Azure Traffic Manager overview
- Related: VNets, subnets and peering, OSI vs TCP/IP for the layer 4 and layer 7 vocabulary.