Azure Front Door Premium Private Link - Managed Private Endpoint Region for DR App Service

Sanjay kumar 40 Reputation points
2026-07-28T20:02:10.96+00:00

We are implementing a regional DR solution using Azure Front Door Premium with Private Link.

Primary App Service: France Central DR App Service: France South

While adding the DR App Service as an origin, France South is not available as a supported Private Link region, so only France Central can be selected.

Our questions are:

  1. Is France Central the recommended Private Link region for an App Service hosted in France South?
  2. If France Central experiences a complete regional outage, will Azure Front Door still be able to reach the France South App Service through Private Link?
  3. Does the managed private endpoint introduce a dependency on the selected Private Link region that could affect regional DR?
Azure Front Door
Azure Front Door

An Azure service that provides a cloud content delivery network with threat protection.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Christos Panagiotidis 3,546 Reputation points
2026-07-29T10:20:56.38+00:00

France Central is a reasonable Private Link location for the France South origin because Front Door Private Link is region-agnostic and Microsoft recommends choosing the nearest supported region. Traffic remains private over Microsoft’s backbone between the managed private endpoint and the App Service.

However, the selected location represents the Front Door regional cluster hosting that endpoint. Using France Central for both origins therefore leaves both private paths dependent on the same cluster. For stronger regional resilience, configure both App Services as Private Link-enabled origins in one origin group, but select a different supported Private Link region for the DR origin. Approve each private endpoint connection, confirm both origins become healthy, and test failover using priorities and health probes. France South does not need to match the endpoint region, but a second endpoint region is recommended so a France Central cluster outage does not remove both private paths.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sina Salam 31,296 Reputation points Volunteer Moderator
    2026-07-29T11:09:59.07+00:00

    Hello Sanjay kumar,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    My understand is that you are designing Azure Front Door Premium with Private Link for a France Central primary App Service and a France South DR App Service, and you need to know whether selecting France Central as the Private Link region for the France South origin preserves regional disaster recovery.

    Azure Front Door Premium Private Link is not just tied to the App Service origin region. Azure Front Door creates a managed private endpoint from a Front Door managed regional private network, and traffic is routed through the Front Door regional cluster that hosts that managed virtual network before reaching the origin over Private Link. Therefore, if both the primary and DR origins use France Central as the Private Link region, the DR path still has a France Central regional Private Link dependency. This does not meet a clean regional DR design if France Central regional-cluster unavailability is part of the failure scenario. - https://learn.microsoft.com/en-us/azure/frontdoor/private-link

    As a solution architect, I recommend configuring the France Central primary origin with Private Link region France Central, and configure the France South DR origin with a different supported Azure Front Door Private Link region, such as West Europe or North Europe, after validating latency. Best practice guidance states that if the origin region is not supported, you should choose the next nearest supported region, and it also recommends using multiple Private Link-enabled origins with different Private Link regions for regional-cluster redundancy. - https://learn.microsoft.com/en-us/azure/frontdoor/private-link

    Use the associated official link resources for more reading and implementation steps:

    I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

    Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

    Was this answer helpful?

    0 comments