# Azure Front Door

> Azure Front Door charges a base fee per profile plus traffic-based meters, and a Premium profile keeps billing that base fee after the project behind it ends. ZopNight discovers profiles with SKU detail through Resource Graph and attributes base and traffic spend from Cost Management so unused profiles surface for review.

Source: https://zop.dev/integrations/azure/front-door
Updated: 2026-08-19

---

Azure Front Door is a global entry point providing CDN, WAF, and Layer-7 routing, billed per profile plus traffic. Premium profiles retained after a project ends keep billing their base fee.

## A base fee per profile, then traffic on top

Front Door's billing splits into a monthly base fee charged per profile (higher on the Premium tier, which bundles managed WAF rules and Private Link origins) and usage meters for requests and data transfer. The traffic meters behave fairly: no requests, no charge. The base fee does not. A profile is a global configuration object, always provisioned across Microsoft's edge, so the platform charges for its existence rather than its activity. Tier choice compounds this: Premium's larger base fee buys security features that a marketing microsite or an internal demo rarely needs.

## Spend attribution for Front Door profiles

Discovered via Azure Resource Graph with SKU detail. Cost Management billing attributes base and traffic spend, supporting review of unused profiles. Front Door offers nothing to stop or scale down short of deletion, so ZopNight's contribution is making the split visible: when a profile's attributed spend is almost entirely base fee with negligible traffic charges, the numbers themselves say the endpoint serves nobody. That split is hard to see in a raw invoice, where Front Door lines blend across profiles.

## Leftover profiles and premium tiers

The waste here has a distinct shape. Launch-and-forget: a Front Door set up for a product launch or event keeps its base fee running long after the domain stopped resolving to it. Tier overshoot: Premium selected by default for workloads that use none of its WAF or Private Link capability, doubling down on the fixed cost. Duplicate entry points: an application migrated to a different ingress such as Application Gateway or a regional LB, while the old profile stayed configured.

## Checking Front Door in the portal

Azure portal → Front Door and CDN profiles lists every profile with its tier. Open a suspect profile and compare its Metrics request counts against the month's base fee. A flat line answers the retention question immediately.