Front Door vs. Traffic Manager vs. Cross-Region Load Balancer

Azure has three services that all claim to route users to the right region. They’re not interchangeable. Picking the wrong one means paying for capability you don’t need, or hitting a wall you can’t route around later.

Here’s the actual difference.

Traffic Manager: DNS only

Traffic Manager doesn’t touch your traffic. It answers DNS queries. A client asks for your domain’s IP, Traffic Manager picks the best one using its routing policy (priority, weighted, performance, or geographic), and hands it back. After that, the client talks directly to your app.

This works for any protocol, not just HTTP. It’s also the cheapest of the three.

The catch: failover speed depends on DNS TTL. If a client cached your domain’s IP an hour ago, it keeps hitting the dead region until that cache expires, even after Traffic Manager has already rerouted new lookups.

Front Door: HTTP(S), at the edge

Front Door is a layer-7 reverse proxy for HTTP and HTTPS traffic. When Front Door Standard/Premium reached general availability in March 2022, it added an Anycast entry point: every user resolves to the same IP address, and the network itself routes each request to the nearest Front Door location.

Because Front Door proxies the actual traffic instead of just answering DNS, failover doesn’t wait on anyone’s DNS cache. You also get a WAF, edge caching, and TLS termination in the same service.

The trade-off: HTTP(S) only, and it costs more than Traffic Manager.

Update (2026): Front Door has since moved from Anycast to unicast routing (rolled out March–April 2026). The entry point now resolves through a name-lookup step that picks the best Front Door location using live health signals, closer to how Traffic Manager works, then routes directly to that location’s IP. The Anycast description above was accurate when this was written. Check current docs before treating it as Front Door’s architecture today.

Cross-Region Load Balancer: TCP/UDP, at the network layer

Cross-Region Load Balancer does for non-HTTP traffic roughly what Front Door does for HTTP. It’s layer 4 (TCP/UDP), it uses an Anycast IP, and it routes to the nearest healthy regional Standard Load Balancer.

Use it when your traffic isn’t HTTP at all: gaming, custom TCP protocols, anything Front Door’s layer-7 proxy doesn’t apply to, but you still want fast, DNS-independent global failover.

What this actually costs

Take a realistic scenario: an app running in 2 regions, 10 million requests a month, about 500 GB going out to clients.

Traffic Manager’s DNS query volume runs far below that request count, since most clients reuse a cached answer instead of looking it up again. At a rough 200,000 queries a month, that’s $0.54 per million queries, about 11 cents. Genuinely negligible.

Cross-Region Load Balancer means 2 regional Standard Load Balancers plus the Global tier on top, each $0.025 an hour for the first 5 rules, plus $0.005 per GB processed at the regional level (the Global tier itself adds no extra per-GB charge). That lands around $57 a month.

Front Door Standard runs $35 a month as a base fee, then $0.083 per GB to clients in North America and $0.009 per 10,000 requests, plus a small charge for data pulled from your origin. Add it up and you’re around $88 a month for the same traffic.

Your actual bill depends on region mix and cache hit rate, but the order of magnitude holds. Traffic Manager costs pennies. Cross-Region Load Balancer costs tens of dollars. Front Door costs tens of dollars too, but you’re not paying separately for WAF or caching on top of it.

How to actually pick

Need any protocol, and can live with DNS-speed failover? Traffic Manager. It’s cheap, and it’s the only one of the three that isn’t HTTP-only.

Need HTTP(S) with WAF, caching, or TLS termination, and failover that doesn’t depend on a client’s DNS cache? Front Door.

Need non-HTTP traffic with fast global failover? Cross-Region Load Balancer.

You can also combine them. Traffic Manager in front of regional Application Gateways is a common pattern when you want layer-7 features without Front Door’s cost, and can accept DNS-speed failover as the trade-off.

Subscribe for more of these.