Load Balancer vs Application Gateway vs Front Door vs Traffic Manager
Verdict: Two axes decide it: HTTP or not, global or regional. Non-HTTP regional is Load Balancer; HTTP regional is Application Gateway; HTTP global is Front Door; non-HTTP global is Traffic Manager.
| Criterion | Standard Load Balancer | Application Gateway | Front Door | Traffic Manager |
|---|---|---|---|---|
| Layer | 4 (TCP/UDP), pass-through | 7 (HTTP/HTTPS) | 7 (HTTP/HTTPS) | DNS - never in the data path |
| Scope | Regional (cross-region variant is still L4) | Regional | Global edge (118+ PoPs) | Global |
| Signature capability | HA ports; ultra-low latency | URL path-based routing; private-only frontend; Private Endpoint backends | TLS at edge, header rewrites, in-flight failover; Premium adds Private Link origins + managed WAF | Any protocol; Geographic routing; TCP health probes |
| Failover speed | Health-probe driven | Health-probe driven | Seconds - proxied at the edge | DNS TTL-bound, not sub-second |
| Choose when | Custom TCP/UDP protocols, gaming, low latency | Single-region web app, WAF_v2, path routing | Global HTTP with edge SSL, caching, WAF | Global non-HTTP (SMTP, SIP) with geo affinity |
Rules
- Choose Standard Load Balancer with HA ports for non-HTTP regional traffic needing ultra-low latency.
- Choose Application Gateway for URL path-based routing to multiple backend pools within one region.
- Choose Front Door Premium - not Standard - when you need Private Link origins or the Microsoft-managed WAF rule set.
- Choose Traffic Manager for global non-HTTP routing: DNS-based, so it works with any protocol.
- Choose private-only Application Gateway when the frontend must have no public IP; a Front Door frontend is always publicly reachable, even with Private Link origins.
Traps
- Application Gateway and Front Door are HTTP/HTTPS only - neither can front a custom TCP protocol; that is Load Balancer territory.
- Traffic Manager never touches the request: it cannot transform headers, and DNS caching means failover is not sub-second.
- Basic Load Balancer was retired on September 30, 2025 - any answer built on it is dead on arrival.