how to clear cache of azure frontdoor?

Question

how to clear cache of azure frontdoor?

Deshmukh, Vijit 516

Hi Team,

I want to purge the azure front door cache using az cli commands.
As per the document I tried the below command, but it is giving info message and error.

command used : az afd endpoint purge -g (resource group name) --profile-name (profile name from endpoint designer) --endpoint-name (endpoint name)
--content-paths '/styles.css'

Please let me know if is there any command to purge azure front door cache.

Screen shot attached.

1 answer

Your answer

Answer 1

GitaraniSharma-MSFT 50,021 Microsoft Employee Moderator

Hello @Deshmukh, Vijit ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to purge Azure Front Door cache using Azure CLI but it is failing with an "AuthorizationFailed" error.

The "AuthorizationFailed" error states that you do not have authorization to perform a purge action on the Front Door endpoint. Could you please check if you have the required permissions and try again?
You should have the following RBAC permission "Microsoft.Network/frontDoors/purge/action" to be able to purge cached content from a Front Door resource.
Refer : https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftnetwork

Now, coming back to the Azure CLI commands,

If you have Azure Front Door Standard/Premium, then you can use the below command to purge cache:
az afd endpoint purge -g group --profile-name profile --domains www.contoso.com --content-paths '/scripts/'*
Refer : https://learn.microsoft.com/en-us/cli/azure/afd/endpoint?view=azure-cli-latest#az-afd-endpoint-purge

If you have Azure Front Door Classic, then you can use the below command to purge cache:
az network front-door purge-endpoint --content-paths '/scripts/' --name name --resource-group rgname*
Refer : https://learn.microsoft.com/en-us/cli/azure/network/front-door?view=azure-cli-latest#az-network-front-door-purge-endpoint

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Deshmukh, Vijit 516 Reputation points

2022-07-13T15:38:36.653+00:00

Hi @GitaraniSharma-MSFT

I have the required access in the azure portal to purge the cache, but not able to do so from my local system power shell terminal although az login works for me

I tried az cli command for premium Azure Front Door .i.e.; *az afd endpoint purge -g group --profile-name profile --domains www.contoso.com --content-paths '/scripts/'**

getting below response in both az cli and cloud shell.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-07-13T16:17:59.893+00:00

Hello @Deshmukh, Vijit ,

Thank you for the update.

Currently, CLI command group 'afd' is in preview and under development, so you could see some warnings and asks for additional parameters.

Looking at your screenshot, it looks like the command is warning that resource ID of the Front Door endpoint is required. So, I would request you to retry the command with --ids parameter.

To get the resource ID of your Azure Front Door endpoint, you can run the below command:
az afd endpoint show -g group --profile-name profile --endpoint-name endpoint1
Refer : https://learn.microsoft.com/en-us/cli/azure/afd/endpoint?view=azure-cli-latest#az-afd-endpoint-show

Once you get the resource ID, try running the purge command with parameter --ids again as below:
az afd endpoint purge -g group --profile-name profile --domains www.contoso.com --content-paths '/scripts/' --ids "/subscriptions/xxxxxxxxxx/resourcegroups/groupname/providers/Microsoft.Cdn/profiles/profilename/afdendpoints/endpointname"*

Refer : https://learn.microsoft.com/en-us/cli/azure/afd/endpoint?view=azure-cli-latest#az-afd-endpoint-purge

Regards,
Gita
Deshmukh, Vijit 516 Reputation points

2022-07-14T09:40:48.537+00:00

Hi @GitaraniSharma-MSFT

Thanks for the command az afd endpoint show -g group --profile-name profile --endpoint-name endpoint1
It worked and I managed to customize the command as per the requirement, below is the command which ran successfully on Azure cloud shell

az afd endpoint purge -g <group> --profile-name <profie-name> --endpoint-name <dev-test-aw4gthipln..azurefd.net> --content-paths '/' --id /subscriptions/<subscription-id>/resourcegroups/<groupname>/providers/Microsoft.Cdn/profiles/<profile-name>/afdendpoints/<e.g. dev-test>*

The same I want to implement on Azure DevOps, but running the same command in Azure DevOps release pipeline, I am getting error message "set az login".
Service connection is in place and we are already using azure devops for CI-CD purpose, deploying the services to Azure App Service.

Please let me know if this issue can be covered

Thanks and Regards,
Vijit
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-07-14T15:05:43.88+00:00

Hello @Deshmukh, Vijit ,

From the screenshot, I see you are using Azure PowerShell environment & PowerShell commands to sign in but the "afd" command used is Azure CLI.
Did you try to sign in using "az login" command?
Refer : https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli#sign-in-with-a-service-principal

NOTE: The "afd" command is in preview which can change in future.

You can also use the Azure Front Door PowerShell command "Clear-AzFrontDoorCdnEndpointContent" to purge Azure Front Door cache.
Refer : https://learn.microsoft.com/en-us/powershell/module/az.cdn/clear-azfrontdoorcdnendpointcontent?view=azps-8.1.0

We also have REST API to perform the cache purge.
Refer : https://learn.microsoft.com/en-us/rest/api/frontdoorservice/azurefrontdoorstandardpremium/afd-endpoints/purge-content?tabs=HTTP

How to use PowerShell to make REST API calls:
https://learn.microsoft.com/en-us/powershell/azure/manage-azure-resources-invoke-azrestmethod?view=azps-8.1.0
https://learn.microsoft.com/en-us/azure/governance/resource-graph/first-query-rest-api#getting-started-with-rest-api

Regards,
Gita Sharma
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-07-18T12:09:08.397+00:00

Hello @Deshmukh, Vijit , Could you please provide an update on this post?
Deshmukh, Vijit 516 Reputation points

2022-07-26T12:09:08.15+00:00

Hi @GitaraniSharma-MSFT
Apologies for the late reply.
I did tried az login but it is not working from pipeline.
When same tried form my local system it worked, as it opens up the browser where I select my email-id and az login gets validated.
Also MFA is enabled for my personal email id.

Pipeline Logs :
2022-07-26T12:03:26.5276540Z ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)')))
2022-07-26T12:03:26.6056978Z Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
2022-07-26T12:03:28.4693132Z ERROR: Please run 'az login' to setup account.

Thanks & Regards,
Vijit Deshmukh
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-07-29T13:45:35.297+00:00
Hello @Deshmukh, Vijit ,

Thank you for the update.

You could try logging into Azure via CLI without a pop-up window using the below commands:

az login -u ******@contoso.com -p VerySecret #Optionally, you can specify a tenant using --tenant contoso.onmicrosoft.com

Refer : https://learn.microsoft.com/en-us/answers/questions/385793/index.html

If you still face issues, then I'd recommend reaching out to our DevOps experts within their dedicated Developer Community as Azure DevOps is currently not supported here on QnA.
Refer : https://developercommunity.visualstudio.com/spaces/21/index.html
https://developercommunity.visualstudio.com/t/az-login-on-azure-pipelines-returns-certificate-ss/1280726?viewtype=all

Regards,
Gita
Deshmukh, Vijit 516 Reputation points

2022-08-01T11:56:52.55+00:00

Hi @GitaraniSharma-MSFT

I tried with the following command :
*az login -u vijit.desh****@ac***e.com -p ****** --tenant e******6f*

But it didn't worked, also followed the links provided , seems it is not supported in this forum.

I am looking for a solution in which we can bypass MFA set in azure portal, as after running az login we need to open browser and select the email id which authenticates.

Please let me know on this

Thanks & Regards,
Vijit Deshmukh
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-08-01T17:22:29.073+00:00

Hello @Deshmukh, Vijit ,

Did you try "az login --use-device-code", which can force device code flow, if no web browser is available or the web browser fails to open.

Also, are you able to sign in to Azure CLI with a service principal?
Refer : https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli#sign-in-with-a-service-principal

Regards,
Gita
Deshmukh, Vijit 516 Reputation points

2022-08-04T07:28:21.537+00:00

Hi @GitaraniSharma-MSFT
I tried with the above command az login --use-device-code
Got the response as :

[command]"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\Agent_1_work_temp\f--------------814.ps1'"
Added TLS 1.2 in session.
[command]Import-Module -Name C:\Program Files\WindowsPowerShell\Modules\Az.Accounts\2.5.3\Az.Accounts.psd1 -Global
[command]Clear-AzContext -Scope CurrentUser -Force -ErrorAction SilentlyContinue
[command]Clear-AzContext -Scope Process
[command]Connect-AzAccount -ServicePrincipal -Tenant -Credential System.Management.Automation.PSCredential -Environment AzureCloud @processScope
[command] Set-AzContext -SubscriptionId 8---------9b -TenantId
ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
Added TLS 1.2 in session.
[warning]A parameter cannot be found that matches parameter name 'and'.
Finishing: Azure Cloud PowerShell Script*

Thanks & Regards,
Vijit Deshmukh
Deshmukh, Vijit 516 Reputation points

2022-08-04T07:36:29.063+00:00

Hi @GitaraniSharma-MSFT I tried with the above command az login --use-device-code Got the response as :

[command]"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\Agent_1_work_temp\fbc--------------------4.ps1'" Added TLS 1.2 in session. [command]Import-Module -Name C:\Program Files\WindowsPowerShell\Modules\Az.Accounts\2.5.3\Az.Accounts.psd1 -Global [command]Clear-AzContext -Scope CurrentUser -Force -ErrorAction SilentlyContinue [command]Clear-AzContext -Scope Process [command]Connect-AzAccount -ServicePrincipal -Tenant *** -Credential System.Management.Automation.PSCredential -Environment AzureCloud @processScope [command] Set-AzContext -SubscriptionId 8-------9b -TenantId *** ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)'))) Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy. Added TLS 1.2 in session. [warning]A parameter cannot be found that matches parameter name 'and'. Finishing: Azure Cloud PowerShell Script*

Thanks & Regards, Vijit Deshmukh
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2022-08-08T16:25:54.947+00:00

Hello @Deshmukh, Vijit ,

Do you have a corporate proxy which is blocking this connection?

The only references that I found for this issue are as below:
https://github.com/MicrosoftDocs/azure-docs-cli/issues/2455
https://stackoverflow.com/questions/55463706/ssl-handshake-error-with-some-azure-cli-commands

Could you try to sign in using an Azure DevOps personal access token (PAT)?
Refer : https://learn.microsoft.com/en-us/azure/devops/cli/log-in-via-pat?view=azure-devops&tabs=windows

If it doesn't work, try posting the issue in the dedicated Developer Community.
Refer : https://developercommunity.visualstudio.com/spaces/21/index.html

Or, if you have a support plan, I request you file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Regards,
Gita

Share via

how to clear cache of azure frontdoor?

1 answer

Your answer