Azure CDN and Front Door (Classic) Retirement: How to Migrate Before 2027

Microsoft is retiring the classic tiers of its content delivery services. If your site or application still runs on Azure Front Door (classic) or Azure CDN Standard from Microsoft (classic), you need to move to Azure Front Door Standard or Premium before the retirement date. Microsoft provides a migration tool, and for most profiles the move can be done without downtime, but there are decisions to make first and the migration cannot be rolled back.

The key dates

Microsoft has also already removed support for managed certificates on the classic tiers and disabled older DHE cipher suites, so classic profiles are steadily losing features before the final date. Check the Azure retirement notices for your subscription, as dates can be updated.

Standard or Premium?

• Standard covers content delivery, custom domains with managed certificates, rules, and WAF with custom rules.
• Premium adds Microsoft-managed WAF rule sets, bot protection and Private Link connections to your origins.

The tier you can choose depends on your current WAF policy: if the classic profile uses managed WAF rules, either move to Premium or remove those managed rules before migrating to Standard. Decide this first, because it changes both security coverage and cost.

Before you migrate

1. Inventory the profile: endpoints, custom domains, routing and rules engine configuration, WAF policies and origins.
2. Check certificates: Standard and Premium require HTTPS on every custom domain. Either use free Front Door managed certificates or, if you bring your own certificate from Key Vault, enable a managed identity so Front Door can read it.
3. Review the WAF policy and decide the tier, as above.
4. Record a baseline: response times, cache hit ratio and error rates, so you can compare after the move.
5. Freeze changes to the classic profile during the migration window; once you start, it can no longer be edited.

The migration steps

For Front Door (classic), the tool is under Settings > Migration on the classic resource in the Azure portal:

1. Validate checks whether the profile is compatible. It reports problems such as managed WAF rules or certificate settings you must change first.
2. Prepare creates the new Standard or Premium profile with your configuration. Review it carefully at this stage.
3. Migrate switches the service over. Microsoft documents that this step cannot be rolled back.

According to Microsoft, no DNS changes are needed during the migration itself: traffic that arrives at the old azurefd.net endpoint is sent to the new profile automatically. Afterwards you update your CNAME records to the new endpoint, verify traffic, then remove the temporary domain and the classic resource. Azure CDN Standard from Microsoft (classic) profiles have a similar migration path to Front Door Standard or Premium.

After the migration

• Compare latency, cache hit ratio and error rates against your baseline
• Confirm every custom domain serves the right certificate and redirects HTTP to HTTPS
• Check WAF logs for new false positives, especially if rule sets changed
• Update CNAMEs to the new endpoint, then remove the classic resources
• Update infrastructure-as-code templates (Bicep, ARM or Terraform) to the new resource types so the next deployment does not recreate the old setup

Is this the time to reconsider your CDN?

A forced migration is a natural moment to check whether Azure Front Door is still the best fit. For many Microsoft-centric estates it is. For others, especially sites whose users are concentrated in regions where another network is stronger, or that need different edge features, a move to another provider may cost less or perform better. Measure before deciding; our guide on how to choose a CDN explains how.

Get help with the migration

TechProvidence engineers plan and carry out CDN migrations with a tested rollback plan and 24/7 support, including moves from the classic Azure tiers. See our CDN management and optimization and managed Azure services, or contact us for a complimentary CDN review.