Load Balancing Options

Regional or global, layer 4 or layer 7

Azure has four load-balancing services, chosen along two axes. Azure Load Balancer is regional, layer 4 (TCP/UDP): very fast, no understanding of HTTP, used in front of VMs and scale sets. Application Gateway is regional, layer 7: TLS termination, path-based routing (/api versus /images), cookie affinity and an optional Web Application Firewall (WAF). Azure Front Door is global, layer 7: it runs on Microsoft's edge network, routes users to the closest healthy backend across regions, caches content like a CDN and includes WAF. Traffic Manager is global and DNS-based: it answers DNS queries with the endpoint chosen by priority, weighting, performance or geography, so it works for any protocol but fails over only as quickly as DNS caches expire.

Decision table

A quick way to pick a service in design reviews.

need                                           service
---------------------------------------------  -------------------------
TCP/UDP spread over VMs in one region          Azure Load Balancer
HTTP routing + WAF inside one region / VNet    Application Gateway
global HTTP entry, edge caching, WAF, failover Azure Front Door
global failover for non-HTTP endpoints via DNS Traffic Manager

common combo: Front Door (global) -> App Gateway or App Service (regional) in 2 regions

Health probes decide everything

Every load balancer routes only to backends its health probe considers healthy. Point probes at a lightweight /health endpoint that checks critical dependencies, not at /, which may return 200 while the database is down.

Quick check: You need a single global HTTPS entry point with WAF and edge caching that fails over between two regions. Which service fits best?

• Azure Front Door
• Azure Load Balancer
• Application Gateway
• Network security group