Applies to: ✔️ Front Door (classic)
Azure Front Door Standard and Premium tier bring the latest cloud delivery network features to Azure. By using enhanced security features and an all-in-one service, you secure your application content and bring it closer to your end users through the Microsoft global network. This article guides you through the migration process to move your Azure Front Door (classic) profile to either a Standard or Premium tier profile with Azure PowerShell.
Prerequisites
- Review the About Front Door tier migration article.
- Ensure your Front Door (classic) profile can be migrated:
- Azure Front Door Standard and Premium require all custom domains to use HTTPS. If you don't have your own certificate, use an Azure Front Door managed certificate. The certificate is free of charge and Azure manages it for you.
- Session affinity is enabled in the origin group settings for an Azure Front Door Standard or Premium profile. In Azure Front Door (classic), set session affinity at the domain level. As part of the migration, session affinity is based on the Front Door (classic) profile settings. If you have two domains in your classic profile that share the same backend pool (origin group), session affinity must be consistent across both domains for migration validation to pass.
- Latest Azure PowerShell module installed locally or Azure Cloud Shell. For more information, see Install and configure Azure PowerShell.
Note
You don't need to make any DNS changes before or during the migration process. However, once the migration finishes and traffic flows through your new Azure Front Door profile, you need to update your DNS records. For more information, see Post-migration endpoint cutover.
Validate compatibility
Open Azure PowerShell and connect to your Azure account. For more information, see Connect to Azure PowerShell.
Test your Azure Front Door (classic) profile to see if it's compatible for migration. Use the Test-AzFrontDoorCdnProfileMigration command to test your profile. Replace the values for the resource group name and resource ID with your own values. Use Get-AzFrontDoor to get the resource ID for your Front Door (classic) profile.
Replace the following values in the command:
<subscriptionId>: Your subscription ID.<resourceGroupName>: The resource group name of the Front Door (classic).<frontdoorClassicName>: The name of the Front Door (classic) profile.
Test-AzFrontDoorCdnProfileMigration -ResourceGroupName <resourceGroupName> -ClassicResourceReferenceId /subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.Network/frontdoors/<frontdoorClassicName>
If the migration is compatible, you see the following output:
CanMigrate DefaultSku
---------- ----------
True Standard_AzureFrontDoor or Premium_AzureFrontDoor
If the migration isn't compatible, you see the following output:
CanMigrate DefaultSku
---------- ----------
False
Prepare for migration
Note
- Managed certificate isn't currently supported for Azure Front Door Standard or Premium in Azure Government Cloud. You need to use BYOC for Azure Front Door Standard or Premium in Azure Government Cloud or wait until this capability is available.
Run the Start-AzFrontDoorCdnProfilePrepareMigration command to prepare for migration. Replace the values for the resource group name, resource ID, and profile name with your own values. For SkuName, use either Standard_AzureFrontDoor or Premium_AzureFrontDoor. The SkuName is based on the output from the Test-AzFrontDoorCdnProfileMigration command.
Replace the following values in the command:
<subscriptionId>: Your subscription ID.<resourceGroupName>: The resource group name of the Front Door (classic).<frontdoorClassicName>: The name of the Front Door (classic) profile.
Start-AzFrontDoorCdnProfilePrepareMigration -ResourceGroupName <resourceGroupName> -ClassicResourceReferenceId /subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.Network/frontdoors/<frontdoorClassicName> -ProfileName myAzureFrontDoor -SkuName Premium_AzureFrontDoor
The output looks similar to the following:
Starting the parameter validation process.
The parameters are successfully validated.
Your new Front Door profile is being created. Wait until the process finishes. This process might take several minutes.
Your new Front Door profile with the configuration is successfully created.
Run the Get-AzFrontDoorWafPolicy command to get the resource ID for your WAF policy. Replace the values for the resource group name and WAF policy name with your own values.
Get-AzFrontDoorWafPolicy -ResourceGroupName myAFDResourceGroup -Name myClassicFrontDoorWAF
The output looks similar to the following:
PolicyMode : Detection
PolicyEnabledState : Enabled
RedirectUrl :
CustomBlockResponseStatusCode : 403
CustomBlockResponseBody :
RequestBodyCheck : Disabled
CustomRules : {}
ManagedRules : {Microsoft.Azure.Commands.FrontDoor.Models.PSAzureManagedRule}
Etag :
ProvisioningState : Succeeded
Sku : Classic_AzureFrontDoor
Tags :
Id : /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myClassicFrontDoorWAF
Name : myFrontDoorWAF
Type :
Run the New-AzFrontDoorCdnMigrationWebApplicationFirewallMappingObject command to create an in-memory object for WAF policy migration. Use the WAF ID in the last step for MigratedFromId. To use an existing WAF policy, replace the value for MigratedToId with a resource ID of a WAF policy that matches the Front Door tier you're migrating to. If you're creating a new WAF policy copy, you can change the name of the WAF policy in the resource ID.
$wafMapping = New-AzFrontDoorCdnMigrationWebApplicationFirewallMappingObject -MigratedFromId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myClassicFrontDoorWAF -MigratedToId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myFrontDoorWAF
Run the Start-AzFrontDoorCdnProfilePrepareMigration command to prepare for migration. Replace the values for the resource group name, resource ID, profile name with your own values. For SkuName use either Standard_AzureFrontDoor or Premium_AzureFrontDoor. The SkuName is based on the output from the Test-AzFrontDoorCdnProfileMigration command.
Replace the following values in the command:
<subscriptionId>: Your subscription ID.<resourceGroupName>: The resource group name of the Front Door (classic).<frontdoorClassicName>: The name of the Front Door (classic) profile.
Start-AzFrontDoorCdnProfilePrepareMigration -ResourceGroupName <resourceGroupName> -ClassicResourceReferenceId /subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.Network/frontdoors/<frontdoorClassicName> -ProfileName myAzureFrontDoor -SkuName Premium_AzureFrontDoor -MigrationWebApplicationFirewallMapping $wafMapping
The output looks similar to the following:
Starting the parameter validation process.
The parameters are successfully validated.
Your new Front Door profile is being created. Wait until the process finishes. This process might take several minutes.
Your new Front Door profile with the configuration is successfully created.
If you're migrating a Front Door profile with BYOC, you need to enable managed identity on the Front Door profile. You need to grant the Front Door profile access to the key vault where the certificate is stored.
Run the Start-AzFrontDoorCdnProfilePrepareMigration command to prepare for migration. Replace the values for the resource group name, resource ID, and profile name with your own values. For SkuName, use either Standard_AzureFrontDoor or Premium_AzureFrontDoor. The SkuName is based on the output from the Test-AzFrontDoorCdnProfileMigration command.
System assigned
For IdentityType use SystemAssigned.
Start-AzFrontDoorCdnProfilePrepareMigration -ResourceGroupName myAFDResourceGroup -ClassicResourceReferenceId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/Frontdoors/myAzureFrontDoorClassic -ProfileName myAzureFrontDoor -SkuName Premium_AzureFrontDoor -IdentityType SystemAssigned
User assigned
Run the Get-AzUserAssignedIdentity command to the get the resource ID for a user assigned identity.
$id = Get-AzUserAssignedIdentity -ResourceGroupName myResourceGroup -Name afduseridentity
$id.Id
The output looks similar to the following:
/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity
For IdentityType use UserAssigned and for IdentityUserAssignedIdentity,* use the resource ID from the previous step.
Replace the following values in the command:
<subscriptionId>: Your subscription ID.<resourceGroupName>: The resource group name of the Front Door (classic).<frontdoorClassicName>: The name of the Front Door (classic) profile.
Start-AzFrontDoorCdnProfilePrepareMigration -ResourceGroupName <resourceGroupName> -ClassicResourceReferenceId /subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.Network/frontdoors/<frontdoorClassicName> -ProfileName myAzureFrontDoor -SkuName Premium_AzureFrontDoor -IdentityType UserAssigned -IdentityUserAssignedIdentity @{"/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity" = @{}}
The output looks similar to the following:
Starting the parameter validation process.
The parameters are successfully validated.
Your new Front Door profile is being created. Wait until the process finishes. This process might take several minutes.
Your new Front Door profile with the configuration is successfully created.
This example shows how to migrate a Front Door profile with multiple WAF policies and enable both system assigned and user assigned identity.
Run the Get-AzFrontDoorWafPolicy command to get the resource ID for your WAF policy. Replace the values for the resource group name and WAF policy name with your own values.
Get-AzFrontDoorWafPolicy -ResourceGroupName myAFDResourceGroup -Name myClassicFrontDoorWAF
The output looks similar to the following:
PolicyMode : Detection
PolicyEnabledState : Enabled
RedirectUrl :
CustomBlockResponseStatusCode : 403
CustomBlockResponseBody :
RequestBodyCheck : Disabled
CustomRules : {}
ManagedRules : {Microsoft.Azure.Commands.FrontDoor.Models.PSAzureManagedRule}
Etag :
ProvisioningState : Succeeded
Sku : Classic_AzureFrontDoor
Tags :
Id : /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myClassicFrontDoorWAF
Name : myFrontDoorWAF
Type :
Run the New-AzFrontDoorCdnMigrationWebApplicationFirewallMappingObject command to create an in-memory object for WAF policy migration. Use the WAF ID in the last step for MigratedFromId. To use an existing WAF policy, replace the value for MigratedToId with a resource ID of a WAF policy that matches the Front Door tier you're migrating to. If you're creating a new WAF policy copy, you can change the name of the WAF policy in the resource ID.
$wafMapping1 = New-AzFrontDoorCdnMigrationWebApplicationFirewallMappingObject -MigratedFromId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myClassicFrontDoorWAF1 -MigratedToId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myFrontDoorWAF1
$wafMapping2 = New-AzFrontDoorCdnMigrationWebApplicationFirewallMappingObject -MigratedFromId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myClassicFrontDoorWAF2 -MigratedToId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.Network/frontdoorwebapplicationfirewallpolicies/myFrontDoorWAF2
Specify both managed identity types in a variable.
$identityType = "SystemAssigned, UserAssigned"
Run the Get-AzUserAssignedIdentity command to the get the resource ID for a user assigned identity.
$id1 = Get-AzUserAssignedIdentity -ResourceGroupName myResourceGroup -Name afduseridentity1
$id1.Id
$id2 = Get-AzUserAssignedIdentity -ResourceGroupName myResourceGroup -Name afduseridentity2
$id2.Id
The output looks similar to the following:
/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity1
/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourcegroups/myAFDResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity2
Specify the user assigned identity resource ID in a variable.
$userInfo = @{
"subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity1" = @{}}
"subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/afduseridentity2" = @{}}
}
Run the Start-AzFrontDoorCdnProfilePrepareMigration command to prepare for migration. Replace the values for the resource group name, resource ID, profile name with your own values. For SkuName use either Standard_AzureFrontDoor or Premium_AzureFrontDoor. The SkuName is based on the output from the Test-AzFrontDoorCdnProfileMigration command. The MigrationWebApplicationFirewallMapping parameter takes an array of WAF policy migration objects. The IdentityType parameter takes a comma separated list of identity types. The IdentityUserAssignedIdentity parameter takes a hash table of user assigned identity resource IDs.
Replace the following values in the command:
<subscriptionId>: Your subscription ID.<resourceGroupName>: The resource group name of the Front Door (classic).<frontdoorClassicName>: The name of the Front Door (classic) profile.
Start-AzFrontDoorCdnProfilePrepareMigration -ResourceGroupName <resourceGroupName> -ClassicResourceReferenceId /subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.Network/frontdoors/<frontdoorClassicName> -ProfileName myAzureFrontDoor -SkuName Premium_AzureFrontDoor -MigrationWebApplicationFirewallMapping @($wafMapping1, $wafMapping2) -IdentityType $identityType -IdentityUserAssignedIdentity $userInfo
The output looks similar to the following:
Starting the parameter validation process.
The parameters are successfully validated.
Your new Front Door profile is being created. Wait until the process finishes. This process might take several minutes.
Your new Front Door profile with the configuration is successfully created.
Migrate
Run the Enable-AzFrontDoorCdnProfileMigration command to migrate your Front Door (classic).
Enable-AzFrontDoorCdnProfileMigration -ProfileName myAzureFrontDoor -ResourceGroupName myAFDResourceGroup
The output looks similar to the following:
Start to migrate.
This process disables your Front Door (classic) profile and moves all your traffic and configurations to the new Front Door profile.
Migrate succeeded.
Run the Stop-AzFrontDoorCdnProfileMigration command to abort the migration process.
Stop-AzFrontDoorCdnProfileMigration -ProfileName myAzureFrontDoor -ResourceGroupName myAFDResourceGroup
The output looks similar to the following:
Start to abort the migration.
Your new Front Door profile is deleted and your existing profile remains active. WAF policies aren't deleted.
Wait until the process finishes. This process can take several minutes.
Abort succeeded.
Post-migration endpoint cutover
Azure Front Door (classic) uses a different fully qualified domain name (FQDN) than Azure Front Door Standard or Premium. For example, a classic endpoint might be contoso.azurefd.net, while a Standard or Premium endpoint might be contoso-mdjf2jfgjf82mnzx.z01.azurefd.net. For more information, see Endpoints in Azure Front Door.
Even though Azure Front Door automatically routes traffic from the classic endpoint to your new Standard or Premium profile without any configuration changes, you must complete the following post-migration action depending on your scenario:
Custom domains: Update the DNS record to point to the new Azure Front Door Standard/Premium endpoint.
Direct use of the classic default endpoint: Replace the classic hostname with the new endpoint hostname in your applications, clients, and integrations.
Both endpoints remain functional during the transition, so you can make and validate this change without downtime.
Warning
Complete the endpoint cutover to the new Azure Front Door Standard/Premium endpoint by March 31, 2028. Starting April 1, 2028, classic endpoints are no longer supported and might stop functioning. Custom domains, applications, or clients that still depend on a classic endpoint might stop receiving traffic.
Related content