Design and Implement Application Delivery Services
Match the service to the layer and the scope
Azure Load Balancer is layer 4. Basic versus Standard matters: Standard adds availability-zone support, HA ports, outbound rules, and is secure by default - no outbound internet until you add an outbound rule or NAT Gateway. Standard also requires the NSG to permit the health probe source. Internal versus public is a separate decision.
Application Gateway is regional layer 7: listeners (basic and multi-site), routing rules, path-based routing, backend pools and settings, health probes, SSL termination or end-to-end TLS, autoscaling and zone redundancy on v2, and WAF on the WAF_v2 SKU. A frequent trap is that the backend health probe must match what the application actually answers on; otherwise all backends are marked unhealthy.
Azure Front Door is global layer 7 with anycast entry points, WAF, caching, and origin groups with priority, weight and latency-based selection. Traffic Manager is DNS-based only - it never sees the payload, so client caching and TTL determine how fast failover appears; routing methods are priority, weighted, performance, geographic, multivalue and subnet.
Worked example: a global HTTP API needs WAF, caching and instant regional failover → Front Door (anycast reacts immediately). A global non-HTTP TCP service on VMs → Traffic Manager for DNS steering plus regional Standard Load Balancers. A single-region internal web app needing path-based routing → Application Gateway.
Rule of thumb: global HTTP(S) → Front Door; global non-HTTP → Traffic Manager; regional HTTP(S) with WAF/paths → Application Gateway; regional layer 4 → Load Balancer.