{"id":59750,"date":"2026-11-12T11:57:29","date_gmt":"2026-11-12T01:57:29","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/12\/azure-front-door-grows-up-with-grpc-edge-actions-and-jwt-security\/"},"modified":"2026-11-12T11:58:53","modified_gmt":"2026-11-12T01:58:53","slug":"azure-front-door-grows-up-with-grpc-edge-actions-and-jwt-security","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/12\/azure-front-door-grows-up-with-grpc-edge-actions-and-jwt-security\/","title":{"rendered":"Azure Front Door Grows Up with gRPC Edge Actions and JWT Security"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Azure Front Door Grows Up with gRPC Edge Actions and JWT Security we will explain how Microsoft\u2019s application delivery service is becoming more useful for modern APIs, AI services and customer-facing platforms.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">Many mid-market businesses have reached an awkward stage. Their applications have grown beyond a single website, but their traffic management still relies on separate gateways, security tools and custom code that nobody wants to touch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Front Door sits in front of these applications and acts as a global entry point. It directs users to a healthy service, improves performance and can block malicious requests before they reach your systems. New support for gRPC, Edge Actions and JSON Web Token validation expands what can happen at that front door.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why these changes matter to the business<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Previously, Azure Front Door was mainly viewed as a global traffic manager, content delivery network and web application firewall. A web application firewall, or WAF, inspects incoming web traffic and blocks common attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It was useful, but organisations often needed extra services or application code to manage modern API traffic, check access tokens or make more advanced routing decisions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The latest capabilities allow more of those decisions to happen close to the user. That can reduce delays, lower the amount of unwanted traffic reaching your applications and simplify parts of the delivery architecture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This does not mean Front Door replaces Azure API Management, application authentication or good software design. It means technology leaders have more choice about where each control should sit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Native gRPC support improves modern service delivery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">gRPC is a communication method commonly used between applications, microservices and AI agents. Instead of exchanging large, human-readable messages, it normally sends smaller binary messages over HTTP\/2, which supports multiple conversations across one connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In business terms, gRPC can help internal services communicate efficiently. It is particularly useful when an application makes frequent calls between components or needs to stream information in real time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Front Door\u2019s native gRPC support is currently in public preview. It can accept a gRPC connection at Microsoft\u2019s edge, choose a healthy destination and forward the call to the application over a separate encrypted HTTP\/2 connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Routes can be matched to a specific gRPC service or method. This gives teams more control over where calls go without exposing every backend service directly to the internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a software company could direct inventory calls to a service in Melbourne while sending document-processing calls to a separate AI service. If an origin becomes unhealthy, Front Door can direct calls to another available origin.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Native gRPC health probes can also check whether a service is ready to receive traffic. This can reduce failed transactions and shorten recovery time during an outage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because gRPC support remains in preview, it should be introduced through a controlled pilot rather than moved immediately into a critical production path. Streaming behaviour, timeouts, monitoring and security policies all need to be tested using realistic traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Edge Actions bring small decisions closer to users<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Edge Actions allow lightweight JavaScript code to run at Azure Front Door locations around the world. The code can examine a request or response and make a quick decision before traffic continues to the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Useful scenarios include rejecting invalid requests, changing headers, rewriting an address, selecting an origin or directing a small percentage of users to a new application version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person company releasing a redesigned customer portal. Instead of building rollout logic into the portal, an Edge Action could direct five per cent of suitable requests to the new version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If monitoring identifies a problem, the traffic can be returned to the stable version. The business outcome is a lower-risk release with less disruption for customers and support teams.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edge Actions are deliberately small. Code is limited to 16 KB and must finish within 10 milliseconds. Up to three versions can be maintained, which supports controlled updates and rollback.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those limits are a useful design signal. Edge Actions should make fast, predictable decisions. They should not contain complex business processes, call slow external systems or become another application that is difficult to maintain.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">JWT validation can stop unsuitable requests earlier<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A JSON Web Token, usually called a JWT, is a signed digital pass presented by a user, device or application. It can identify who issued the token, which service it is intended for and when it expires.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edge Actions can examine these tokens and reject requests that do not meet defined requirements. For example, a request could be denied if the token is missing, expired or intended for a different application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The high-level decision might look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IF the request has no access token\n return 401 Unauthorized\n\nIF the token is expired or for the wrong application\n return 403 Forbidden\n\nOTHERWISE\n send the request to the selected healthy origin<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This early screening can reduce unwanted load on APIs and application servers. It also provides a more consistent first check when several development teams are publishing services behind the same Front Door profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, JWT validation at the edge should not become the only authentication control for sensitive systems. If Edge Action code exceeds its execution limit, Front Door can continue processing without that action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Critical APIs should therefore validate identity again at the application or through a service such as Azure API Management. Edge validation is best treated as an additional checkpoint, not the sole lock on the door.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same layered principle applies to partner integrations. Certificate controls covered in our Azure Front Door mutual TLS playbook can identify trusted partner systems, while tokens can control what those systems are permitted to do.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical architecture for a mid-market application<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A sensible design separates traffic according to its purpose and risk rather than forcing every request through identical controls.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/public\/* Website content and caching\n\/api\/customer\/* WAF, JWT checks and API controls\n\/grpc.Inventory\/* Native gRPC routing and health probes\n\/admin\/* Strong identity checks and tighter WAF policy<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Public content can prioritise speed and caching. Customer APIs can receive token checks and rate limits. Administrative functions can have much stricter controls than general website traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This builds naturally on route-level WAF policies, which let organisations apply different web application firewall protections to sign-in, payment, API and public routes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For AI and agent-based applications, gRPC can also provide an efficient communication option between services. The surrounding controls remain important, as discussed in our guide to production-ready A2A agents on Azure Container Apps.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What should CIOs and CTOs ask their teams?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Which services are publicly exposed?<\/strong> There should be a documented reason for every direct internet-facing origin.<\/li>\n<li><strong>Where is identity actually validated?<\/strong> Edge screening must not accidentally replace application-level authentication.<\/li>\n<li><strong>Are gRPC limitations understood?<\/strong> Preview features should have a rollback plan and production-like testing.<\/li>\n<li><strong>Who owns Edge Action code?<\/strong> It needs version control, testing, approval and monitoring like any other code.<\/li>\n<li><strong>Are Front Door and WAF logs enabled?<\/strong> Without usable logs, security incidents and failed requests are much harder to investigate.<\/li>\n<li><strong>Is the design genuinely simpler?<\/strong> Adding another feature is only worthwhile if it reduces risk, cost or operational effort.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These capabilities can support broader Australian Cyber Security Centre guidance by reducing exposure and improving monitoring. They do not, by themselves, deliver Essential 8 compliance, which is the Australian government\u2019s baseline cybersecurity framework covering areas such as patching, multifactor authentication and backups.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The opportunity is controlled simplification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Front Door is growing from a global web entry point into a more capable application delivery layer. Native gRPC can improve modern service routing, Edge Actions can remove small decisions from backend applications, and JWT checks can filter unsuitable requests earlier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real benefit is not using every new feature. It is creating a simpler path from users to applications while keeping identity, security and failure controls clear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a Melbourne-based Microsoft Partner and Wiz Security Integrator, CloudProInc combines more than 20 years of enterprise IT experience with hands-on Azure, Defender, Wiz and application security work. We help organisations decide which controls belong at the edge and which should remain deeper in the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether your current application delivery setup is protecting the business or simply adding cost and complexity, we are happy to take a practical look with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Azure Front Door can now handle modern application traffic and make security decisions closer to users. Here is what gRPC, Edge Actions and JWT validation mean for mid-market businesses.<\/p>\n","protected":false},"author":1,"featured_media":59752,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,19,13,69],"tags":[],"class_list":["post-59750","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-azure","category-azure-security","category-blog","category-microservices"],"jetpack-related-posts":[{"id":59622,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/07\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door\/","url_meta":{"origin":59750,"position":0},"title":"A Plain-English Guide to Post-Quantum TLS on Azure Front Door","author":"CPI Staff","date":"November 7, 2026","format":false,"excerpt":"Azure Front Door can now protect customer-facing connections with hybrid post-quantum TLS. Here is what changed, what remains exposed and how security leaders should respond.","rel":"","context":"In &quot;Azure Security&quot;","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 1x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 1.5x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 2x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 3x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 4x"},"classes":[]},{"id":59646,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/08\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now\/","url_meta":{"origin":59750,"position":1},"title":"Post-Quantum TLS on Azure Front Door What Leaders Should Do Now","author":"CPI Staff","date":"November 8, 2026","format":false,"excerpt":"Azure Front Door now supports hybrid post-quantum TLS. Learn what it protects, where gaps remain and the practical steps Australian security leaders should take now.","rel":"","context":"In &quot;Azure Security&quot;","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 1x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 1.5x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 2x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 3x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 4x"},"classes":[]},{"id":59666,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/09\/post-quantum-tls-on-azure-app-service-and-functions-explained\/","url_meta":{"origin":59750,"position":2},"title":"Post-Quantum TLS on Azure App Service and Functions Explained","author":"CPI Staff","date":"November 9, 2026","format":false,"excerpt":"Microsoft has added post-quantum protection to Azure App Service and Functions. Learn what it protects, where gaps remain and what CIOs should ask their teams to check.","rel":"","context":"In &quot;App Service&quot;","block_context":{"text":"App Service","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/app-service\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png 1x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png 1.5x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png 2x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png 3x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png 4x"},"classes":[]},{"id":59313,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/22\/hardening-azure-front-door-waf-with-service-tag-match-conditions\/","url_meta":{"origin":59750,"position":3},"title":"Hardening Azure Front Door WAF with Service Tag Match Conditions","author":"CPI Staff","date":"October 22, 2026","format":false,"excerpt":"Service tag matching lets Azure Front Door Premium WAF control Azure service traffic without fragile IP lists. Learn how to scope, test and deploy these rules safely.","rel":"","context":"In &quot;Azure Security&quot;","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 1x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 1.5x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 2x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 3x, \/wp-content\/uploads\/2026\/10\/hardening-azure-front-door-waf-with-service-tag-match-conditions.png 4x"},"classes":[]},{"id":59471,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/29\/how-route-level-waf-policies-simplify-azure-front-door-security\/","url_meta":{"origin":59750,"position":4},"title":"How Route-Level WAF Policies Simplify Azure Front Door Security","author":"CPI Staff","date":"October 29, 2026","format":false,"excerpt":"Use Azure Front Door route-level WAF policies to maintain a consistent security baseline while applying tighter controls to sensitive sign-in, payment and API traffic.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png 1x, \/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png 1.5x, \/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png 2x, \/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png 3x, \/wp-content\/uploads\/2026\/10\/how-route-level-waf-policies-simplify-azure-front-door-security.png 4x"},"classes":[]},{"id":58491,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis\/","url_meta":{"origin":59750,"position":5},"title":"A Practical Azure Front Door Mutual TLS Playbook for B2B APIs","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how Azure Front Door mutual TLS can block unknown systems, strengthen partner API security, and reduce the operational risk of certificate-based B2B integrations.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 1x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 1.5x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 2x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 3x, \/wp-content\/uploads\/2026\/08\/a-practical-azure-front-door-mutual-tls-playbook-for-b2b-apis.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/azure-front-door-grows-up-with-grpc-edge-actions-and-jwt-security.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59750"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59750\/revisions"}],"predecessor-version":[{"id":59753,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59750\/revisions\/59753"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59752"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}