Azure Front Door classic retirement and Cloud Services exit: 31 March 2027

Summary. Azure Front Door (classic) and Cloud Services (extended support) both retire on 31 March 2027, 144 days from 7 November 2026. Front Door (classic) has refused new profiles since 1 April 2025 and managed certificates since 15 August 2025. Microsoft's zero-downtime tool moves a classic profile to Standard or Premium, but there is no rollback once you commit, and DNS must point at the new endpoints by 31 March 2028. The new tiers add a $35 (Standard) or $330 (Premium) monthly base fee per profile, drop routing-rule charges and cut egress rates. Microsoft's examples show savings of about 45% to 68%, but higher bills for request-heavy traffic and many-profile estates. For Cloud Services, Microsoft names Service Fabric managed clusters as the target, refuses extensions and offers no one-click tool. Service Fabric also ends support for Windows Server 2022 that day, so build on Windows Server 2025. If a Cloud Services rewrite has not started, that is your critical path, not Front Door.

About this article. Written for platform, DevOps and FinOps teams that still run either service. We checked every date, price and migration step against Microsoft Learn, Microsoft's lifecycle list, Azure Updates notices, the Azure pricing page and the Azure Retail Prices API on 7 November 2026, and recomputed every cost figure. Microsoft labels its pricing scenarios as illustrative and list prices change, so price your own traffic before you commit; this is not financial advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

Two retirements, one date: the timeline

Sources: Azure Updates notices, the tier-migration guide and the Service Fabric versions page. Microsoft's 2027 lifecycle list puts Front Door (classic) on 31 March 2027 with other Azure items such as Application Gateway WAF v2 Config and four M-series v2 VM sizes. Cloud Services (extended support) is not on that list; its date comes from its own overview and notice. The list also still shows Windows Server 2022 on AKS retiring on 15 March 2027, which is now out of date.

What stops working on 1 April 2027

For Front Door (classic), Microsoft's FAQ lists four losses: you can no longer create or manage classic resources, reach their data through the portal, APIs, SDKs or client tools, receive updates, or get support. Until then you can still update existing classic profiles. The retirement covers the public cloud and Azure Government in Arizona and Texas.

One problem may already be live. Microsoft said classic managed certificates renewed before 15 August 2025 would keep working until 14 April 2026, and told customers to switch to their own certificates or migrate. That window has closed, so check the certificate on every classic custom domain today.

For Cloud Services (extended support), the Service Fabric migration FAQ says workloads must move to Service Fabric managed clusters by 31 March 2027 to avoid disruption, and that Microsoft cannot grant extensions. Plan as if the platform stops serving traffic then.

Azure Front Door (classic): how the migration tool works

The migration changes the control plane while the data plane stays the same, which is why Microsoft calls it zero-downtime. A simple profile moves in minutes; complex ones take longer. There are three phases, or five if you bring your own certificate (BYOC):

1. Validate compatibility. Every custom domain must use HTTPS (an Azure-managed certificate is free). Session affinity moves from the domain to the origin group, so domains sharing a backend pool need matching affinity settings. In PowerShell this is Test-AzFrontDoorCdnProfileMigration.

1. Prepare. Azure builds a new profile from your classic configuration and copies each WAF policy or maps it to an existing one. You get a read-only view, and the classic profile is now locked. In PowerShell: Start-AzFrontDoorCdnProfilePrepareMigration.

1. Enable managed identity, for BYOC only.

1. Grant that identity access to Key Vault, again for BYOC only.

1. Migrate. Enable-AzFrontDoorCdnProfileMigration disables the classic profile and activates the new one. Before this step you can abort with Stop-AzFrontDoorCdnProfileMigration, which deletes the new profile (WAF policy copies stay for you to delete). After it there is no abort or rollback.

Billing for the new tier starts when migration completes. Then delete the classic resource.

Which tier you land on

The tool picks the tier from your WAF policy. Managed rules push you to Premium unless you first remove them or the policy association. Custom rules only land you on Standard, with an option to upgrade. You can move Standard to Premium later but never Premium to Standard. A profile that exceeds Standard's quotas goes to Premium automatically. Migrations through PowerShell, the CLI, the API or Terraform need WAF policies created separately. In Azure Government, the new tiers do not yet support managed certificates, so BYOC is required.

Breaking changes your pipelines will notice

• Resource provider. Classic uses Microsoft.Network; Standard and Premium use Microsoft.Cdn, so every Terraform, Bicep, script and CLI call that touches Front Door needs rewriting.

• Endpoint names. New endpoints carry a hash to prevent subdomain takeover, in the form <endpointname>-<hashvalue>.z01.azurefd.net.

• Logs and metrics. Diagnostic logs and metrics are not migrated and log fields differ, so dashboards, alerts and SIEM parsers break until rebuilt. The new tiers add health probe logs and built-in reports.

• Rules. URL redirect and rewrite move out of routing rules into rule sets named urlRewriteMigrated and urlRedirectMigrated. Caching duration can only be set in a rule set.

• Governance. Azure Policy for WAF is not available for Standard and Premium, so any control that relied on it needs a replacement.

Cost: when the new tiers are cheaper and when they are not

The pricing models differ in structure, not just rates.

The table follows Microsoft's comparison, which sends anyone needing managed WAF rules, bot protection or Private Link to Premium; base fees and request rates match the Retail Prices API and pricing page on 7 November 2026.

Microsoft's scenarios show the pattern. A static site with custom WAF rules falls from $3,507.50 to $1,727 a month on Standard; Microsoft calls that about 45% cheaper, though its two totals are about 51% apart. An Indian file-download workload falls from $40,444 to $12,827.34 (68% lower) on cheaper egress. A request-heavy workload with 5 billion requests costs about 5% more on Premium. An estate of 80 classic profiles moved one to one to Premium rises from $17,551.30 to about $30,000 a month, 1.7 times more, because of 80 base fees; trimming to 60 workloads hosted as 15 endpoints in each of four Premium profiles brings Microsoft's estimate to $4,885. Since 27 October 2026, Premium also accepts WAF policies at profile and route level, which helps consolidation.

Worked example: six profiles, custom WAF rules only

Take six hypothetical classic profiles (two production, four non-production), each with 8 routing rules, carrying 5 TB a month of North American traffic and 200 million requests in total, with a 5% cache miss rate. List prices: $0.17 per GB (classic) and $0.083 (Standard) for the first 10 TB, $0.009 per 10,000 Standard requests, $0.02 per GB from edge to origin:

WAF, inbound transfer and origin-to-edge bandwidth are excluded. On these items Standard is about 51% cheaper. One caveat: Microsoft's comparison charges $0.03 an hour for each of the first five rules, while the pricing page lists $0.03 an hour for the first five. If your invoice shows one charge for that block, classic routing costs 6 × ($0.03 + 3 × $0.012) × 730 = $289.08, the classic total $1,139.08, and Standard saves about 29%.

Now suppose one production profile uses a managed WAF rule set. If every profile follows it to Premium, base fees alone reach 6 × $330 = $1,980 a month, more than the whole classic total. Keep non-production on Standard and rebuild production as two endpoints in one Premium profile, and base fees fall to 4 × $35 + $330 = $470, or $35 + $330 = $365 if non-production shares one Standard profile (Standard allows 10 endpoints per profile, Premium 25). The tool migrates one classic profile to one new profile, so decide the layout first.

DNS and certificate cutover risks

The tool routes the old classic hostname to your new profile. The DNS work comes afterwards, and that is where incidents happen.

• CNAMEs must move by 31 March 2028. Point each custom domain's CNAME at the new hashed endpoint and replace any direct use of the classic hostname. Both endpoints work meanwhile, so you can cut over and validate without downtime.

• Expired managed certificates. If a classic managed certificate has already expired when you migrate, the certificate moves to Pending Revalidation or starts to rotate within one to two days. You can also regenerate the validation token and add the new _dnsauth.<subdomain> TXT record yourself. Tokens expire after seven days and the default TXT TTL is one hour, so an old record can block validation until it ages out.

• Automatic rotation needs a direct CNAME. Front Door renews managed certificates on its own only when the CNAME points straight at the endpoint. A records, CNAME chains and apex domains using CNAME flattening need manual revalidation 45 days before expiry, so fix the record type during cutover. With public certificate lifetimes falling to 100 days from 15 March 2027, manual steps will come round more often; see our 100-day certificate checklist.

• CAA records. Managed certificates are issued by DigiCert. If your zone publishes CAA records, add 0 issue digicert.com or issuance can fail.

• Bring-your-own certificates. The key vault must sit in the same subscription as the Front Door profile, certificates must be uploaded from PFX files as certificate objects rather than secrets, and elliptic-curve certificates are not supported. Set the version to Latest so renewals deploy automatically within 72 hours.

• Lower TTLs first. Cut TTLs a few days ahead, switch during low traffic, and keep the old endpoint until logs show no traffic.

Cloud Services moves add a different DNS risk. A cloud service (extended support) takes its DNS label from its public IP resource, so a new platform usually means new hostnames and IP addresses. Find every partner allowlist, firewall rule and hardcoded hostname first. VIP swap works only between two cloud services, so it cannot carry traffic to the new platform. Instead, put Front Door Standard or Premium in front of both deployments and shift traffic with origin priorities and weights. That makes the Front Door migration a prerequisite for a clean Cloud Services cutover.

Cloud Services (extended support): picking a landing zone

Microsoft's retirement notice and FAQ name Service Fabric managed clusters as the target, at the same rate for the same VM size, with no one-click tooling because each application must adapt how its code runs on the nodes. Microsoft's decision matrix rates the alternatives by migration complexity:

What a Service Fabric managed cluster move involves

Microsoft's migration guide maps the pieces: a web role becomes a stateless ASP.NET Core service, a worker role becomes a stateless service with its logic in RunAsync, RoleEntryPoint maps to a ServiceInstanceListener or RunAsync, and .cscfg and .csdef settings move into application and service manifests. GitHub examples cover web roles, worker roles and state management.

Three details change plans. First, the guide says managed clusters do not yet support containers, so workloads with IIS or Windows server-component dependencies that need containerising must use a traditional Service Fabric cluster. Second, Microsoft recommends the Standard SKU for production, and Standard needs at least five nodes (Basic, for testing, needs three). A cloud service on two instances today will need more VMs, so the same rate does not mean the same bill; if you plan to reserve capacity, check our Reserved VM Instances guide first. Third, Service Fabric ends support for clusters on Windows Server 2019 and 2022 on 31 March 2027, and lists Windows Server 2025 as supported until 13 November 2029. Build the new cluster on Windows Server 2025, or you inherit a second migration on day one.

If you choose AKS with Windows node pools, the old 15 March 2027 date no longer applies: AKS has extended Windows Server 2022 to 30 June 2028, with no support on Kubernetes 1.37 and later and node images removed on 30 June 2029. Start on Windows Server 2025 anyway, and plan versions with our Kubernetes 1.35 end-of-life calendar.

Decision table

Checklist: November 2026 to March 2027

1. This month: list every classic Front Door profile and Cloud Services deployment across subscriptions, name an owner for each, and check classic certificate expiry dates.

1. Now: choose a Cloud Services landing zone per role, stand up the target (on Windows Server 2025 where Windows is needed), and start porting configuration and startup tasks.

1. November: export Front Door request count and billable response size by client region, price both tiers, and decide the profile layout.

1. November to December: fix validation blockers: HTTPS on every custom domain, consistent session affinity, Key Vault access for BYOC, CAA records.

1. December: rewrite infrastructure as code for Microsoft.Cdn, rebuild log queries and alerts, and replace Azure Policy WAF controls.

1. December to January: migrate non-production Front Door profiles, then production, and move CNAMEs soon after.

1. February: run old and new Cloud Services deployments in parallel behind Front Door, shift traffic with origin weights, and update partner allowlists.

1. By mid-March 2027: complete cutover with two weeks of buffer, then delete classic resources once traffic is zero.

India note

Front Door is a global edge service, so the retirement does not by itself change a data residency position. Microsoft's India example (file downloads, 150 TB a month) saves about 68% on Standard, because classic charges $0.34 per GB for the first 10 TB to Indian clients against $0.109 on the new tiers. And because diagnostic logs do not migrate, pick a Log Analytics workspace or storage account in the region your data-protection policy requires before you enable logging. For wider cost work, see our FinOps guide for Indian cloud teams.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cloud migration services team can inventory both services across subscriptions, cost Front Door tier and profile layouts, rewrite infrastructure as code for the new resource provider, and move Cloud Services roles to App Service, Container Apps, scale sets or Service Fabric. Talk to us at /contact-us/.

Last updated: 7 November 2026.

References

1. Azure Front Door (classic) retirement FAQ — Microsoft Learn

1. About Azure Cloud Services (extended support) — Microsoft Learn

1. Azure Front Door (classic) to Standard or Premium tier migration — Microsoft Learn

1. Compare pricing between Azure Front Door tiers — Microsoft Learn

1. Azure Retail Prices API, Azure Front Door Service consumption meters — Microsoft

1. FAQ for converting Azure Cloud Services (extended support) apps to Service Fabric — Microsoft Learn

1. Retirement: Service Fabric support for Windows Server 2022 ends on March 31, 2027, 1 April 2026 — Microsoft Azure Updates

1. Azure Front Door (classic) will be retired on 31 March 2027, 27 March 2024 — Microsoft Azure Updates

1. Retirement: Azure Front Door (classic) and Azure CDN from Microsoft Classic SKU ending CNAME based domain validation and new domain/profile creations by August 15, 2025 — Microsoft Azure Updates

1. Retirement: Cloud Services (Extended Support) to Be Retired on March 31, 2027, 31 March 2025 — Microsoft Azure Updates

1. Azure Service Fabric versions — Microsoft Learn

1. Ending Support in 2027 — Microsoft Learn (Lifecycle)

1. Migrate Azure Front Door (classic) to Standard/Premium tier with Azure PowerShell — Microsoft Learn

1. Migrate Azure Front Door (classic) to Standard or Premium tier — Microsoft Learn

1. Upgrade from Azure Front Door Standard to Premium — Microsoft Learn

1. Settings mapping between Azure Front Door (classic) and Standard/Premium tier — Microsoft Learn

1. Azure Front Door pricing — Microsoft Azure

1. Generally Available: Azure Front Door profile and route level WAF policies, 27 October 2026 — Microsoft Azure Updates

1. Azure subscription and service limits, quotas, and constraints (Azure Front Door Standard and Premium limits) — Microsoft Learn

1. Domains, Azure Front Door — Microsoft Learn

1. Traffic routing methods for origins, Azure Front Door — Microsoft Learn

1. Azure Cloud Services migration decision matrix — Microsoft Learn

1. Migrate from Azure Cloud Services to Service Fabric — Microsoft Learn

1. Web Role migration example — Azure Service Fabric Troubleshooting Guides on GitHub

1. Service Fabric managed clusters — Microsoft Learn

1. Windows Server 2022 will retire on June 30, 2028. Removal on June 30, 2029 (issue 4168) — Azure AKS on GitHub

1. Upgrade the operating system version for your AKS Windows workloads — Microsoft Learn