🛡️ Azure subscription has multiple sparse Front Door profiles🟢

• Contextual name: 🛡️ Subscription has multiple sparse Front Door profiles🟢
• ID: /ce/ca/azure/front-door/subscription-has-multiple-sparse-profiles
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: BEST_PRACTICE
• Policy Categories: COST

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Subscription
  • 🔌 Azure Front Door Profile - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies Azure subscriptions with multiple provisioned Azure Front Door Standard or Premium profiles that each contain exactly one provisioned endpoint. These profiles can be candidates for a consolidation review.

Rationale

Azure Front Door profiles define a management boundary for endpoints, routes, domains, origin groups, rulesets, Web Application Firewall policies, and diagnostics. Multiple singleton profiles can duplicate configuration and operational effort. Where workloads have compatible tier, security, routing, and ownership requirements, consolidating them can simplify management and may reduce costs.

Impact

This is a review finding, not a directive to merge profiles. Consolidation can affect custom-domain validation, DNS, TLS certificates, routing, Web Application Firewall coverage, logging, access controls, and availability. Moving a workload between profiles requires a planned migration and rollback path.

Audit

This policy evaluates Azure Front Door profiles in an Azure subscription.

... see more

Remediation

Open File

Remediation

Treat this finding as a consolidation review, not an automatic change request. Do not merge profiles solely because this policy reports a finding.

Review compatibility

For each candidate profile, inventory its endpoints, routes, custom domains, origin groups, rule sets, Web Application Firewall policies, managed identities, diagnostic settings, ownership, tier, and capacity requirements. Consolidate only workloads with compatible security, routing, availability, and operational requirements.

Migrate safely

Azure Front Door endpoints are created under a profile and should be migrated by creating and validating the required configuration in the target profile. Validate custom-domain ownership, certificates, DNS, routing, health probes, WAF coverage, logging, and rollback before switching traffic. Keep the source profile until the migrated workload is verified in production.

After validation, remove the unused endpoints and profile according to the change-management process. Monitor availability, latency, and security telemetry after the change.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Resource Optimization			37		no data