Home / Azure

AzureHow-toIntermediate

Highly available web apps on Azure: zone-redundant App Service behind Front Door

Make an App Service app survive instance and zone failures with zone redundancy, then add Azure Front Door with health probes, WAF and private origins as the step towards multi-region.

Deepak Bhardwaj2 min read

Applies toAzure App Service Premium v3/v4, Azure Front Door Standard/Premium

1. Zone-redundant App Service plan

az appservice plan create -g rg-web -n asp-web-prod-cin --sku P1v3 --is-linux \
  --zone-redundant --number-of-workers 3
  • Minimum 3 instances; the platform spreads them across zones.
  • Zone redundancy is a plan property; on many existing plans it can't be switched on later, so create the plan with it.
  • Dependencies must match: Azure SQL zone-redundant, Redis zone-redundant, storage ZRS/GZRS, Key Vault (zone-resilient by default in zone regions).

2. Health checks

Set the App Service health check path (/healthz) so failing instances get taken out of rotation. Return 200 only when the app can serve requests.

3. Azure Front Door in front

Front Door gives global anycast entry, TLS, caching, WAF and origin health probing, and makes the jump to a second region a configuration change.

az afd profile create -g rg-edge -n afd-web --sku Premium_AzureFrontDoor
az afd endpoint create -g rg-edge --profile-name afd-web -n web-prod --enabled-state Enabled
az afd origin-group create -g rg-edge --profile-name afd-web -n og-web \
  --probe-request-type GET --probe-protocol Https --probe-path /healthz --probe-interval-in-seconds 30 \
  --sample-size 4 --successful-samples-required 3 --additional-latency-in-milliseconds 50
az afd origin create -g rg-edge --profile-name afd-web --origin-group-name og-web -n cin \
  --host-name app-web-prod-cin.azurewebsites.net --origin-host-header app-web-prod-cin.azurewebsites.net \
  --priority 1 --weight 1000 --enabled-state Enabled --http-port 80 --https-port 443

4. Lock down the origin

  • Premium: use Private Link origins so the App Service has no public access.
  • Standard: App Service access restriction allowing only the AzureFrontDoor.Backend service tag and checking the X-Azure-FDID header equals your profile ID.

5. WAF

Managed rule set (DRS) + bot protection in Detection mode first, review logs, then Prevention. Add rate limiting rules for login and API endpoints.

Failure behaviour

Failure Result
One instance crashes Health check removes it; others serve
One zone down Remaining instances in other zones serve; scale out if needed
Region down Single region → outage. Add a second origin in another region (priority 2) for active-passive DR

Tip

Keep Front Door probe paths cheap. Probes come from many edge locations; a heavy /healthz that queries the database can become real load.

Related fixes