An Azure service that provides a cloud content delivery network with threat protection.
Re-save the affected enabled route to republish its configuration after subscription reactivation, wait 10–30 minutes, and then test both the azurefd.net endpoint and custom domain.
Republish the Front Door configuration
Your screenshots already show the endpoints and routes as Enabled, provisioning as Succeeded, domains selected, and origin groups associated. Therefore, avoid deleting the profile or changing DNS first.
- In Azure portal, open the Front Door profile.
- Select Front Door manager.
- Open the affected route.
- Confirm these existing values remain selected:
- Enabled route
- The intended endpoint and domains
- The intended origin group
- A matching path pattern, normally
/*for all paths
- Re-select the existing origin group or another existing value without changing routing behavior, and select Update or Save.
- If the portal does not generate an update for an unchanged value, make a reversible route change during a maintenance window, save it, restore the original value, and save again. Do not remove a production domain unless an interruption is acceptable.
- Allow at least 10 minutes for configuration propagation, then retest:
-
https://<endpoint>.azurefd.net/ -
https://<custom-domain>/
-
Front Door configuration changes can take up to 10 minutes to propagate, with some changes taking longer across edge locations.^1^
Validate the route and custom-domain association
If the custom domain still returns 404, open Front Door profile → Front Door manager → affected route and verify that the custom domain is explicitly included under Domains. A custom domain requires a route to the selected origin group even when a route already exists for the default azurefd.net hostname.^2^
For Front Door Standard/Premium, also check Settings → Domains:
- Provisioning state: Provisioned
- Validation state: Approved
- Endpoint association: The expected endpoint and route
- DNS state: CNAME points to the expected Front Door endpoint
A custom domain needs a TXT record for ownership validation and a CNAME record to direct traffic to Front Door.^3^ If the domain shows Unassociated, select it, choose Associate endpoint and routes, select the endpoint and route, and save.^4^
If both the default endpoint and custom domain show the same Front Door configuration-not-found page, DNS alone is unlikely to explain the failure.
Run the Front Door diagnostic
Capture the request’s Reference String:
- Open the failing page in Microsoft Edge.
- Press F12 and select Network.
- Refresh the page and select the failed request.
- Under Response headers, copy
X-Azure-Ref. - In Azure portal, open the Front Door profile.
- Select Diagnose and solve problems → Connectivity → 4xx and 5xx errors.
- Enter the Reference String and select Run Diagnostics.
The diagnostic can take up to 15 minutes.^5^
Escalation paths
- If the subscription is not fully Active, or resource creation and management remain unavailable more than 30 minutes after reactivation, contact Azure Billing Support. That 30-minute threshold concerns resource-management delays; it is not a guaranteed Front Door traffic-recovery time.^6^
- If the subscription is Active, the republished route still shows Succeeded, and both hostnames continue returning the configuration-not-found page, create an Azure Front Door technical support request.^7^
Include the profile and endpoint names, subscription reactivation time, affected hostnames, UTC test time, HTTP status, X-Azure-Ref, diagnostic result, and screenshots of the enabled route/domain/origin associations. Do not post tenant or subscription identifiers publicly.
References
- Troubleshoot Azure Front Door file compression
- Troubleshoot common issues - Azure Front Door | Microsoft Learn
- Domains - Azure Front Door | Microsoft Learn
- Add a Custom Domain - Azure Front Door | Microsoft Learn
- Troubleshoot 4xx and 5xx errors using Reference String
- Reactivate a disabled Azure subscription
- Support and Troubleshooting - Azure Front Door | Microsoft Learn