Azure CDN for Static Assets, APIs, and Front Door

If your users are spread across the globe but your servers are sitting in Virginia, you’ll probably hear complaints about slow load times, especially from places like Australia.

CDNs fix this by caching static assets closer to where your users are. Azure CDN does exactly that, and it fits well if you're already using Azure services. You can hook it up to Blob Storage, App Services, or your origin.

This guide covers how to set it up, what to expect, and how to know it’s working.

What is Azure CDN?

Azure CDN is Microsoft’s content delivery network. It caches static content at edge locations across the globe to reduce latency and improve load times.

When a user requests a file—say, a JavaScript bundle or an image—it’s served from the nearest edge server, not your main origin. This means faster response times, especially for users far from your primary region.

It works with common asset types like images, stylesheets, JavaScript files, videos, and even API responses. You can use it with static sites, dynamic web apps, or anywhere you need to serve content globally.

How to Organize Delivery with Azure CDN Profiles and Endpoints

Azure CDN groups its configuration into profiles and endpoints. A profile is just a container. Inside it, you define one or more endpoints, each representing a specific origin and delivery path.

You start by creating a CDN profile. Then, add endpoints under that profile. Each endpoint connects to an origin (like a storage account, web app, or custom server) and gets a unique URL, usually something like yourname.azureedge.net.

That URL is what your users hit. Azure CDN pulls content from the origin, caches it at edge locations, and serves it from there.

You can use multiple endpoints under a single profile. That’s helpful if you want to serve different apps or apply different caching rules without spinning up separate profiles.

Azure CDN vs Azure Front Door: What’s the Difference?

Azure offers two services for delivering content at scale—Azure CDN and Azure Front Door. While they overlap in a few areas, they solve different problems.

Here’s how they differ:

Azure CDN: Fast Static Content Delivery

• Optimized for caching and delivering static files (images, JS, CSS, videos).
• Ideal when you need faster load times for globally distributed users.
• Integrates with Blob Storage, App Services, or custom origins.
• Offers basic DDoS protection and HTTPS with custom domains.

Use it when you're serving mostly static assets and want to keep things simple.

Azure Front Door: Dynamic Delivery + Global Load Balancing

• Designed for dynamic content and application-level routing.
• Handles SSL offloading, session affinity, path-based routing, and latency-based traffic steering.
• Comes with built-in health checks and Web Application Firewall (WAF).
• Better suited for complex applications with multiple backend regions or service tiers.

When Azure Front Door is Helpful

Azure CDN works well for static content like images, JavaScript, and CSS. But if you're dealing with APIs, dynamic content, or traffic routing based on regions or backend health, it's not always enough. In those cases, Azure Front Door gives you more flexibility and control.

Where Front Door Fits Better

• Apps with multiple backends or regions
  Front Door can route users based on latency and availability, which helps keep performance consistent across the board.
• More control over routing
  You can define rules like “all /api traffic goes to this backend” or “send /blog to another origin entirely.” Handy if your app isn’t a monolith.
• Built-in protections
  You get things like SSL offloading, automatic HTTPS redirection, and optional Web Application Firewall (WAF). Not part of the standard Azure CDN setup.
• Session affinity support
  Useful when your app expects the same user to hit the same backend during a session—Front Door can handle that without extra plumbing.

Front Door isn’t a replacement for CDN; it solves a different class of problems. If you just want to speed up static assets, stick with CDN. But if your app needs smarter routing, dynamic content support, or better security defaults, Front Door is worth considering.

Azure CDN Provider: Standard vs Premium Tiers

Azure CDN is available through multiple providers, each offering different features, pricing, and performance profiles. These are grouped into Standard and Premium tiers.

Standard Tier

The Standard tier includes Microsoft, Akamai, and Verizon options.

• Microsoft Standard CDN offers solid global coverage, integrates well with other Azure services, and supports basic caching configurations. It's a good fit for most applications that need fast delivery without complex rules.
• Standard Verizon adds a bit more flexibility in caching behavior but still sticks to the essentials.

Premium Tier

Premium CDN is available via Verizon and unlocks more advanced features:

• Real-time purge APIs
• Granular caching rules
• Better analytics and reporting
• API rate limiting
• Enhanced security options

This tier is useful for applications that need tighter control over content delivery, compliance-grade monitoring, or enterprise-scale traffic handling.

Quick Comparison

In most cases, the Standard tier is more than enough. But if your use case involves sensitive content, custom rules, or detailed delivery metrics, the Premium tier gives you more control.

How to Set Up Azure CDN

Getting Azure CDN up and running is pretty straightforward. You’ll need an Azure subscription and a content origin; this could be Azure Blob Storage, a web app, or a custom server. You can set it up through the Azure Portal or CLI.

Option 1: Using the Azure Portal

Start from the Azure Portal:

• Go to Create a resource → search for Front Door and CDN profiles
• Click Create, then select Explore other offerings
• Choose Azure CDN Standard from Microsoft (classic) and hit Continue

Next, fill in the basics:

• Subscription and Resource group — reuse or create new
• Profile name — must be globally unique
• Pricing tier — pick based on feature needs
• Skip “Create endpoint now” for cleaner setup

Once your profile is created, add an endpoint:

• Go to the profile → click + Endpoint
• Enter a unique name (e.g. cdn-endpoint-xyz)
• Choose your Origin type (Storage, Web App, or Custom)
• Set the Origin hostname — usually your origin’s public URL
• Leave advanced settings as-is for now

It can take 5–30 minutes to fully provision, depending on the provider.

Option 2: Using Azure CLI

If you’re comfortable with the terminal, here’s how to do the same thing with the az CLI:

# Create the CDN profile
az cdn profile create \
  --name mycdnprofile \
  --resource-group myresourcegroup \
  --location global \
  --sku Standard_Microsoft

# Add the endpoint
az cdn endpoint create \
  --name myendpoint \
  --profile-name mycdnprofile \
  --resource-group myresourcegroup \
  --origin myapp.azurewebsites.net

You’ll get a CDN endpoint like myendpoint.azureedge.netready to serve cached content from the nearest edge location.

How Azure CDN Handles Caching

Caching is where Azure CDN starts to shine, if you get the rules right. It controls how long content stays at the edge before Azure checks back with your origin. A solid caching strategy can lower latency, cut bandwidth costs, and take some pressure off your backend.

By default, Azure CDN respects the HTTP cache headers set by your origin. But you’re not locked into that. You can override those settings with custom rules, tuned to your content types and delivery patterns.

Static vs. Dynamic Content

• Static assets like images, CSS, or JavaScript can be cached for hours, even days. They don’t change often, so longer cache durations mean fewer trips to your origin.
• Dynamic content—API responses, dashboards, user-specific views—needs a shorter TTL. Sometimes, you may want to avoid caching it entirely.

Custom Rules You Can Configure

You can tweak caching behavior based on:

• File extensions or paths
• Protocol (HTTP vs HTTPS)
• Query strings

A Note on Query Strings

By default, Azure CDN ignores query strings when caching. So style.css?v=1 and style.css?v=2 will likely serve the same cached file—bad news if you’re using query params for versioning.

You can fix this by choosing how the CDN handles query strings:

• Cache all variations (good for cache-busting)
• Ignore all query strings
• Cache based on specific parameters

What Origin Shield Brings to the Table

Origin Shield adds a middle layer between edge locations and your backend. Instead of multiple edge nodes requesting the same file from your origin, a designated "shield" location handles it. This helps during cache misses or regional spikes, reducing backend load.

Example: Setting Cache Headers in Your App

// Cache API data for 5 minutes
app.get('/api/data', (req, res) => {
  res.set('Cache-Control', 'public, max-age=300');
  res.json({ data: 'your data here' });
});

// Cache static files for 1 year
app.get('/static/*', (req, res) => {
  res.set('Cache-Control', 'public, max-age=31536000');
  // Serve static content
});

CDN caching isn’t just about speed. It’s about making smart decisions—what stays, what refreshes, and when. There's no universal setting that works for every app, so tweak it based on how your users interact with your content.

Monitoring Bandwidth, Hits, and Cache

Once your CDN is live, it’s important to keep an eye on how it behaves. Monitoring helps you fine-tune caching rules, catch performance issues, and understand how users are interacting with your content.

Azure CDN integrates with Azure Monitor, which gives you visibility into:

• Bandwidth usage – how much data is flowing out
• Request count – total hits to your CDN
• Cache hit ratio – how often content is served from the edge

These metrics are a solid starting point. But if you're dealing with high-cardinality traffic or operating at scale, you’ll want more visibility than Azure Monitor alone provides.

Tools like Grafana, or Last9, for instance, can surface CDN patterns with richer telemetry without overwhelming you with noise or cost.

Set Up HTTPS, WAF, and Token Auth with Azure CDN

Security in a CDN setup isn’t just about flipping on HTTPS. Azure CDN gives you a few tools to make sure your content is served safely and only to the right people.

Use your domain with HTTPS

By default, your CDN endpoint lives under *.azureedge.net. But you can map a custom domain (like cdn.yoursite.com) and serve it over HTTPS. You’ve got two options for SSL certs:

• CDN-managed certificates — low effort, auto-renewed.
• Azure Key Vault certificates — more control, if you’re managing your certs.

Control who gets access

Not all content should be public. Azure CDN supports:

• IP allow/block lists
• Geo filtering
• Token-based authentication

These are especially useful when serving region-specific content or restricting premium assets to logged-in users.

Redirect HTTP to HTTPS

If someone hits your content over HTTP, you probably want to push them to HTTPS by default. That’s easy to configure at the CDN level—no code changes needed.

For stronger security, plug in a WAF

Azure CDN by itself doesn’t have built-in WAF (Web Application Firewall) support. But if you need protection against things like SQL injection or XSS, you can pair Azure CDN with Azure Front Door. It gives you rule-based filtering, bot protection, and rate limiting at the edge.

Common Azure CDN Issues (and How to Fix Them)

Here are a few common problems developers face when working with Azure CDN, and how to deal with them:

1. Stale Content After Deploys

One of the most frequent gotchas: your app updates, but the CDN keeps serving the old version. That’s because edge servers still have cached copies.
Use the purge command to clear outdated content:

az cdn endpoint purge \
  --resource-group myresourcegroup \
  --name myendpoint \
  --profile-name mycdnprofile \
  --content-paths "/*"

Keep in mind: purging isn’t instant. Propagation can take a few minutes across all edge locations.

2. Mixed Content Warnings

If your site uses HTTPS but pulls assets (like images or scripts) over HTTP, browsers will flag it.
Always serve CDN content over HTTPS, and turn on automatic HTTP-to-HTTPS redirection in your CDN config.

3. Weird Geographic Routing

Sometimes users in, say, Singapore get routed through a faraway edge server. It’s rare, but it happens—especially when your traffic is still ramping up.
Azure’s edge network usually self-corrects over time, but if it doesn’t, raise a support ticket.

4. Origin Server Gets Hammered

Cache misses or sudden cache expiry across regions can spike traffic to your origin. This can slow things down or even knock it over.
Fix: Enable Origin Shield. It adds a layer between edge nodes and your origin, so only one node requests the missing asset.

Tip: Check CDN Status

Here’s how to view endpoint details if you’re troubleshooting:

az cdn endpoint show \
  --resource-group myresourcegroup \
  --name myendpoint \
  --profile-name mycdnprofile

How to Reduce Azure CDN Costs Through Better Configuration

CDNs are fast, but with overprovisioning features, things can get expensive fast. Here's how to keep your Azure CDN spend in check without compromising on performance.

Pick the Right Pricing Tier

Don’t pay for features you don’t need. Most use cases work just fine on the Standard tier, which is significantly cheaper than Premium. Start there. If you hit feature limits, you can always upgrade later.

Tune Your Caching

The more your CDN serves from the edge, the less you pay in origin traffic.
Some easy wins:

• Set longer cache durations for static files (images, CSS, JS).
• Avoid unnecessary purges that trigger re-fetching from your origin.
• Use query string rules wisely to prevent unnecessary cache splits.

Watch What Eats Bandwidth

Large media files (like uncompressed images and videos) tend to be the biggest bandwidth hogs.
Some low-effort optimizations:

• Compress images (use WebP or AVIF formats)
• Resize images before delivery—not on the fly
• Use Brotli or gzip compression for text-based assets

Don’t Go Global Without Reason

If your users are mostly in one or two regions, there’s no need to serve content from everywhere. Set geographic restrictions to avoid paying for unnecessary edge coverage.

Enable Origin Shield

Origin Shield acts as a regional cache buffer. It reduces how often your origin gets hit, especially useful during large-scale cache invalidations. It can cut down egress costs from your origin server, too.

Get the Best Performance from Azure CDN

A CDN can speed things up, but only if it’s configured well. Here are a few practices that help improve performance and reduce unnecessary origin load:

• Warm up your cache
  For critical assets—like homepage images, fonts, or key JavaScript files—it helps to prepopulate the CDN cache. This avoids cold starts, especially for traffic coming in from different regions.
• Set clear cache headers
  CDN behavior is driven by headers like Cache-Control, ETag, and Last-Modified. Be intentional with what you cache and for how long. Static content can be cached for days; dynamic responses might need shorter TTLs or no caching at all.
• Enable compression
  Azure CDN supports Brotli and gzip compression for text-based content like HTML, CSS, and JavaScript. Make sure it’s turned on—this can reduce file sizes and improve load times significantly.
• Optimize images for mobile
  Use appropriately sized images and responsive formats like WebP. Serving large desktop images to mobile users increases load times and wastes bandwidth.
• Measure what matters
  Tools like Google PageSpeed Insights or Lighthouse can show how your CDN setup affects real performance metrics, like Time to First Byte (TTFB) and Largest Contentful Paint (LCP). Review these regularly and adjust configurations if needed.

Wrapping Up

Getting started with Azure CDN is quick, but tuning it for real-world use takes some iteration.

And if you're looking to go beyond basic metrics, Last9 helps you dig into high-cardinality telemetry, so you can see exactly how your CDN is performing, without the noise.

Get started for free today!

FAQs

How long does it take for Azure CDN to propagate changes?

Content propagation typically takes 10-15 minutes for standard tiers and can be faster with premium tiers. Cache purging operations usually complete within 2-5 minutes globally.

Can I use Azure CDN with non-Azure-hosted applications?

Yes, Azure CDN supports custom origins, allowing you to use it with applications hosted on any platform or cloud provider. You just need to specify your origin server URL during endpoint configuration.

What's the difference between Azure CDN and Azure Front Door?

Azure CDN focuses on content caching and delivery, while Azure Front Door provides additional features like load balancing, WAF, and application-layer routing. Front Door includes CDN functionality but offers more comprehensive application delivery features.

How do I handle dynamic content with Azure CDN?

Configure shorter cache durations for dynamic content or use query string parameters to create unique cache keys. You can also exclude certain paths from caching entirely for real-time content.

What happens if my origin server goes down?

Azure CDN continues serving cached content even if your origin server is unavailable. However, requests for non-cached content will fail until your origin server recovers. This is why proper caching strategies are important for availability.