How to configure Azure Front Door for a static website: step by step

João Barros 01 de September de 2026 4 min read

This tutorial shows how to configure Azure Front Door to serve a static website hosted in Azure Blob Storage, adding CDN, managed HTTPS and global routing. It is useful to reduce latency, improve availability and have TLS with minimal effort.

Prerequisites

Azure account with permissions to create resources (Subscription).
Azure CLI installed (az) or access to the Azure Portal.
A simple static website (HTML/CSS/JS files) ready to upload.
Optional custom domain (e.g.: example.com) with access to create a CNAME record.

Step 1: Create a Storage Account with Static Website

Create a Storage Account with support for static website. The site will reside in a container $web and will be the backend for Front Door.

az storage account create --name mystaticstore --resource-group MyRG --location northeurope --sku Standard_LRS --kind StorageV2

# activar static website
az storage blob service-properties update --account-name mystaticstore --static-website --index-document index.html --404-document 404.html

# carregar ficheiros (exemplo) - assume que tem AZURE_STORAGE_KEY ou use --auth-mode login
az storage blob upload-batch --account-name mystaticstore -s ./site-files -d '$web'

Step 2: Create a Front Door (Premium or Standard)

Azure Front Door provides CDN, routing and WAF (optional). Here we use a Front Door Standard/Premium profile. In the example we use the CLI to create a basic Front Door that points to the static website endpoint.

# criar resource group se necessário
az group create --name MyRG --location northeurope

# criar Front Door profile (Standard_Plus ou Premium_AzureFrontDoor)
az network front-door create --resource-group MyRG --name MyFrontDoor --frontend-endpoints MyFrontEnd --backend-pool-name MyBackendPool --backend-address "mystaticstore.z13.web.core.windows.net" --sku Standard_AzureFrontDoor

Step 3: Configure frontend endpoint and TLS (HTTPS)

Front Door creates a *.azurefd.net endpoint by default. For automatic HTTPS without managing certificates, enable managed TLS. If you use a custom domain, add a CNAME and enable managed HTTPS (Azure will provide the certificate).

# exemplo: adicionar frontend custom domain (substitua pelo seu domínio)
az network front-door frontend-endpoint create --resource-group MyRG --front-door-name MyFrontDoor --name www --host-name www.example.com

# após validar o CNAME no seu DNS, habilitar HTTPS (managed)
az network front-door frontend-endpoint update --resource-group MyRG --front-door-name MyFrontDoor --name www --session-affinity-enabled false --certificate-source FrontDoor

Step 4: Routing rules and compression

Define rules so that requests to Front Door are routed to the $web backend. You can also enable compression and set cache TTL to improve performance.

# criar route simples que encaminha todos os caminhos para o backend
az network front-door routing-rule create --resource-group MyRG --front-door-name MyFrontDoor --name DefaultRoute --frontend-endpoints MyFrontEnd --accepted-protocols Http Https --patterns-to-match '/*' --route-type Forward --backend-pool MyBackendPool

# ajustar caching e compressão via Azure Portal (UI) se necessitar de regras mais granulares

Step 5: Configure custom domain (optional) and CNAME

If you use a custom domain, create a CNAME record that points to the Front Door endpoint (e.g.: myfrontdoor.azurefd.net). Then validate in Front Door and wait for the managed certificate issuance.

# exemplo conceptual: no DNS do domínio criar
# CNAME www.example.com -> myfrontdoor.azurefd.net

# no Azure, adicionar e validar frontend custom (já mostrado no passo 3)

Verify the result

Open the Front Door endpoint (e.g.: https://myfrontdoor.azurefd.net or https://www.example.com). You should see the content of your index.html served over HTTPS. Check response headers to confirm cache and CDN:

curl -I https://myfrontdoor.azurefd.net
# Procure cabeçalhos como: x-cache, x-ms-request-id e um status 200

Conclusion

With Azure Front Door connected to a static website in Blob Storage you gained global CDN, managed TLS and routing with little effort. Next steps: enable WAF on Front Door Premium, tune cache TTL per route and configure compression or HTTP->HTTPS redirection rules. Tip: test cache changes with query strings and cache-busting to avoid serving outdated content.