Azure Front Door and Azure CDN are billed mainly on data transfer out to clients and request volume, so the single biggest cost lever is the cache hit ratio: every byte the edge serves from cache is a byte your origin does not pay egress on and a request your origin does not process. Raising the hit ratio with longer, deliberate cache durations, consistent cache keys, and compression routinely moves the majority of traffic to the edge, which cuts both the Front Door bill and the origin egress and compute behind it. The second lever is tier discipline, paying for the Standard tier when you do not need the Premium WAF and managed rules, and the third is keeping large static assets on a caching path rather than streaming them repeatedly from origin.
This guide walks the meters that drive the bill, the cache mechanics that decide most of it, and a worked example of how a content heavy estate moved traffic to the edge and cut delivery cost.
What exactly are you paying for at the edge?
Azure Front Door charges on three things that move largely independently. The first is data transfer out, the volume of bytes delivered from the edge to end users, priced per gigabyte and varying by destination region. The second is the request count, billed per ten thousand requests, which matters for high traffic, small payload workloads such as APIs. The third is the tier base fee and feature usage: the Standard tier covers content delivery and basic routing, while the Premium tier adds the managed Web Application Firewall, bot protection, and private origin connectivity, at a higher base fee plus per policy and per rule charges. Azure CDN, by contrast, is a thinner product priced largely on egress and requests with fewer routing and security features. The practical consequence is that two estates with identical traffic can have very different bills depending on cache behaviour and tier choice.
Why does the cache hit ratio decide most of the bill?
When a request is served from the edge cache, the origin does nothing: no compute, no origin egress, and a faster response for the user. When it is a cache miss, the edge fetches from origin, you pay origin egress into the network, the origin spends compute, and you still pay the edge delivery to the user. A low hit ratio therefore means you pay twice for the same content. Moving the hit ratio from a mediocre level to a high one shifts the dominant share of traffic onto the cheaper edge path and removes a large slice of origin egress at the same time. Three mechanics raise it.
| Lever | Mechanism | Effect on cost |
|---|---|---|
| Cache duration | Set deliberate cache control max age on cacheable assets so the edge holds them longer instead of revalidating against origin | Fewer origin fetches, lower origin egress and compute |
| Cache key hygiene | Strip query strings and headers that fragment the cache so identical content shares one cached object instead of many | Higher hit ratio, fewer duplicate origin fetches |
| Compression | Enable compression so text, scripts, and styles transfer as fewer bytes | Lower data transfer out, the dominant meter |
| Tier right sizing | Use Standard where you do not need Premium WAF and managed rules | Lower base fee and per rule charges |
The cache key point is the one teams miss most. If a marketing tag appends a unique query string to every asset URL, the edge treats each one as a distinct object and the hit ratio collapses even though the content is identical. Normalising the cache key fixes that without any code change to the application.
When is Premium worth it and when is it waste?
The Premium tier earns its base fee when you genuinely use the managed WAF rule sets, bot protection, and private link origins, which together replace separate security products and origin exposure. It is waste when a team selected Premium for a feature it never enabled, or when a low risk static site is paying for application firewall capacity it does not need. The buyer move is to inventory which Premium features are actually in force, attribute the base fee and per policy charges to them, and downgrade profiles that are paying for protection they do not use. Treat the WAF as a security decision with a price, not a default.
Pull your Front Door cache hit ratio and your origin egress side by side. If the hit ratio is mediocre while origin egress is high, you are paying twice for the same bytes, and cache duration plus cache key hygiene will remove most of it before you touch the tier.
A worked example
A European SaaS company delivered a content heavy application through Azure Front Door Premium with a mediocre cache hit ratio because a tracking parameter fragmented the cache key and most assets carried short cache durations. We normalised the cache key to ignore the tracking parameter, set deliberate cache durations on static assets, enabled compression, and moved one low risk static property off Premium onto Standard. The hit ratio rose sharply, origin egress fell as the edge began serving the majority of bytes, and the combined Front Door and origin delivery cost dropped by a large margin while response times improved. Figures are verified against billing data and anonymized.
Where this fits in the Azure estate
Edge delivery is one slice of a wider Azure platform bill that also includes the application platform and data services behind it. See which platform tiers actually cut the bill in PaaS choices that cut the Azure bill, govern the fastest growing line in Azure OpenAI spend governance, and read the full estate picture in the Azure cost optimization guide. The cross cloud view of how the four providers price delivery and egress lives in the cross cloud cost optimization guide.
Frequently asked questions
How is Azure Front Door billed?
What is the difference between Azure Front Door and Azure CDN?
How do you cut Azure Front Door and CDN cost?
Take the next step on your cloud spend
We are an independent buyer side advisory that cuts public cloud spend across AWS, Azure, GCP, and OCI. We hold over $2.4B in annual cloud spend under management, take zero provider commissions, and deliver a 31 percent median reduction in the first 90 days. Our guarantee is simple: we reduce your cloud spend or we reimburse our service fee. Pricing is either a Fixed Fee scoped up front or Gainshare, a share of verified savings with no retainer and no risk to you.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.