Azure Front Door Health Probe Marking Backend as Healthy Despite 4XX Response

Question

I’m facing an issue with Azure Front Door (AFD) health probes where a backend is returning a 403 response, but AFD still considers it healthy. This is causing unexpected routing behavior, as traffic continues to be sent to an unhealthy backend instead of failing over to the next priority endpoint.

Issue Details:

• If I stop an Azure App Service or something goes wrong with the application, the backend sometimes responds with a 403 status code instead of a connection failure.
• AFD health probes do not treat 403 as a failure, so it keeps routing traffic to this backend.
• Expected behavior: AFD should recognize 403 as an unhealthy response and fail over to the next available backend.

Questions:

1. How can I configure AFD to treat a 403 response as unhealthy?
2. Is there a way to customize the status codes that AFD considers for backend health?
3. **What are the best practices to ensure proper failover when an application is not responding correctly?**I’m facing an issue with Azure Front Door (AFD) health probes where a backend is returning a 403 response, but AFD still considers it healthy. This is causing unexpected routing behavior, as traffic continues to be sent to an unhealthy backend instead of failing over to the next priority endpoint. Issue Details:
   • If I stop an Azure App Service or something goes wrong with the application, the backend sometimes responds with a 403 status code instead of a connection failure.
   • AFD health probes do not treat 403 as a failure, so it keeps routing traffic to this backend.
   • Expected behavior: AFD should recognize 403 as an unhealthy response and fail over to the next available backend.
   Questions:
   1. How can I configure AFD to treat a 403 response as unhealthy?
   2. Is there a way to customize the status codes that AFD considers for backend health?
   3. What are the best practices to ensure proper failover when an application is not responding correctly?

Answer 1

Hi @Shivaji Chate,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I did a lab at the end and tested this scenario. I created two App Services and added them behind Front Door. Then, I stopped one of the App Services. I am also facing the same issue—traffic did not go to the healthy origin; instead, it redirected to the unhealthy origin.

I resolved this issue by setting the latency sensitivity property to 0

The latency sensitivity property is by default set to 0, which means that the request will always be forwarded to the fastest backend.

Is there a way to customize the status codes that AFD considers for backend health?

No, It's not possible

Refer this document: https://learn.microsoft.com/en-us/azure/frontdoor/health-probes#health-probe-responses

---

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.