Migrate Azure CDN from Microsoft (classic) to Standard/Premium tier

Azure Front Door Standard and Premium tier bring the latest cloud delivery network features to Azure. By using enhanced security features and an all-in-one service, your application content is secured and closer to your end users through the Microsoft global network. This article guides you through the migration process to move your Azure CDN from Microsoft (classic) profile to either a Standard or Premium tier profile.

Prerequisites

Review the About Azure CDN from Microsoft (classic) migration article.

Validate compatibility

1. Go to your Azure CDN from Microsoft (classic) resource and select Migration from under Settings.

2. Select Validate to see if your Azure CDN from Microsoft (classic) profile is compatible for migration. Validation can take up to two minutes depending on the complexity of your CDN profile.

   

   If the migration isn't compatible, select View errors to see the list of errors and recommendations to resolve them.

3. Once your Azure CDN from Microsoft (classic) profile validates and is compatible for migration, you can move onto the prepare phase.

Prepare for migration

1. The Azure Front Door profile name stays the same as the Azure CDN from Microsoft (classic) profile name. You can't change this name.

2. Select Standard or Premium tier based on your business requirements. Select the Premium tier to take advantage of the full feature set of Azure Front Door.

   Note

   If your Azure CDN from Microsoft (classic) profile can migrate to the Standard tier but the number of resources exceeds the Standard tier limits, you'll be migrated to the Premium tier.

3. Change the endpoint name if the CDN endpoint name length exceeds the maximum of 46 characters. This change isn't required if the endpoint name is within the character limit. For more information, see Azure Front Door endpoints. Since the maximum endpoint length for Azure Front Door is 64 characters, Azure adds a 16 character hash to the end of the endpoint name to ensure uniqueness and to prevent subdomain takeovers.

4. If you have geo filtering rules in Azure CDN, Azure Front Door creates a Web Application Firewall (WAF) custom rule with the same tier as the Front Door profile.

5. Select Prepare, and when prompted, select Yes to confirm that you want to proceed with the migration process. After you confirm, you can't make any further changes to the Azure CDN from Microsoft (classic) profile.

6. Select the link that appears to view the configuration of the new Front Door profile. At this time, you can review each of the settings for the new profile to ensure all settings are correct. When you finish reviewing the read-only profile, select the X in the top right corner of the page to return to the migration screen.

   

Enable managed identities

If you use your own certificate, you need to enable managed identity so Azure Front Door can access the certificate in your Azure Key Vault. Managed identity is a feature of Microsoft Entra ID that you use to securely connect to other Azure services without managing credentials. For more information, see What are managed identities for Azure resources?

1. Select Enable and then select either System assigned or User assigned depending on the type of managed identities you want to use.

   • System assigned - Toggle the status to On and then select Save.

   • User assigned - To create a user assigned managed identity, see Create a user-assigned identity. If you already have a user managed identity, select the identity, and then select Add.

2. Select the X in the top right corner to return to the migration page. You see that you successfully enabled managed identities.

Grant manage identity to Key Vault

Select Grant to add the managed identity to all Azure Key Vaults used with the Front Door (classic) profile.

Migrate

Select Migrate to start the migration process. When prompted, select Yes to confirm you want to proceed with the migration. The migration can take a few minutes depending on the complexity of your Front Door (classic) profile.

Post-migration endpoint cutover

Azure CDN from Microsoft (classic) uses a different fully qualified domain name (FQDN) than Azure Front Door Standard or Premium. For example, a classic endpoint might be contoso.azurefd.net, while a Standard or Premium endpoint might be contoso-mdjf2jfgjf82mnzx.z01.azurefd.net. For more information, see Endpoints in Azure Front Door.

Even though Azure Front Door automatically routes traffic from the classic endpoint to your new Standard or Premium profile without any configuration changes, you must complete the following post-migration action(s) depending on your scenario:

• Custom domains: Update the DNS record to point to the new Azure Front Door Standard/Premium endpoint.

• Direct use of the classic default endpoint: Replace the classic hostname with the new endpoint hostname in your applications, clients, and integrations.

Both endpoints remain functional during the transition, so you can make and validate this change without downtime.

Next step