Azure Application Gateway
Load balancing software
Web application firewalls (WAF)
DevSecOps software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if Azure Application Gateway and its alternatives fit your requirements.
Pay-as-you-go
Free Trial
Free version unavailable
Small
Medium
Large
- Public sector and nonprofit organizations
- Education and training
- Banking and insurance
What is Azure Application Gateway
Azure Application Gateway is a managed Layer 7 (HTTP/HTTPS) load balancer for applications hosted in Microsoft Azure. It routes and balances web traffic using URL-based routing, host-based routing, and TLS termination, and it can add a web application firewall policy for common web threats. It is typically used by cloud and platform teams operating Azure virtual networks, Kubernetes ingress patterns, or multi-site web applications that need centralized traffic management and security controls. The service integrates with Azure-native monitoring, identity, and policy tooling and is configured through the Azure portal, ARM/Bicep, CLI, and Terraform.
Layer 7 routing features
It supports host-based and path-based routing, redirects, rewrites, and TLS termination at the gateway. This enables consolidating multiple web apps behind a single entry point and applying consistent routing rules. It also supports session affinity and health probes to steer traffic based on backend availability.
Integrated WAF option
It offers an optional Web Application Firewall tier that uses managed rule sets and supports custom rules. This allows teams to apply common web threat protections (for example, OWASP-aligned rules) at the edge of an Azure virtual network. Centralized WAF policies can reduce the need to deploy separate security appliances for basic application-layer filtering.
Azure-native operations and IaC
It integrates with Azure Monitor, Log Analytics, and diagnostic logs for operational visibility. Configuration is available via Azure Resource Manager templates/Bicep, CLI, and Terraform, supporting DevSecOps workflows and repeatable deployments. It also aligns with Azure networking constructs (VNets, subnets, private endpoints) for consistent governance and access control.
Azure-centric deployment model
It is designed primarily for workloads inside Azure virtual networks and does not function as a general-purpose, cloud-agnostic load balancer. Organizations running significant on-prem or multi-cloud ingress may need additional components to achieve consistent traffic management across environments. This can increase architectural complexity when standardizing across heterogeneous infrastructure.
Cost and SKU complexity
Pricing depends on gateway SKU/tier, capacity units, and enabled features such as WAF, which can make forecasting harder than simpler reverse proxies. Scaling and feature selection often require understanding Azure-specific limits and sizing concepts. For smaller deployments, the managed service overhead may be higher than lightweight alternatives.
Less extensible than proxies
As a managed service, it provides a defined feature set and does not offer the same level of low-level customization as self-managed proxies (for example, custom modules or bespoke request processing). Advanced edge logic, highly customized routing behaviors, or non-HTTP protocols may require other Azure services or additional layers. This can lead to multiple ingress components when requirements exceed the gateway’s supported capabilities.
Plan & Pricing
Pricing model: Pay-as-you-go (combination of fixed gateway-hour charge + variable Capacity Unit (CU) charges)
Free tier/trial: Azure free account: $200 credit for 30 days (applies to Application Gateway usage while credits last). No permanently free Application Gateway tier found.
Example costs (East US, documented examples):
- Fixed (gateway-hour): Standard_v2 – $0.246 per gateway-hour; WAF_v2 – $0.443 per gateway-hour.
- Variable (capacity unit per hour): 1 CU – Standard_v2 $0.008 per CU-hour; WAF_v2 $0.0144 per CU-hour.
Application Gateway for Containers (documented example, East US 2):
- Application Gateway for Container resource: $0.017 per application-gateway-for-container-hour; with WAF: $0.031 per hour.
- Frontend: $0.01 per frontend-hour; with WAF: $0.018 per frontend-hour.
- Association: $0.12 per association-hour; with WAF: $0.216 per association-hour.
- Capacity Unit: $0.008 per CU-hour; with WAF: $0.014 per CU-hour.
Data processing / transfer notes (from official docs):
- Data processing is charged per GB after included thresholds (e.g., medium/large sizes include some TB/month); outbound data charged at standard Azure data transfer rates; inbound data is free.
Discount options / purchase notes:
- No public reserved-instance pricing shown for Application Gateway on the pricing pages; Azure advises contacting sales and shows purchase options (EA/partner/program-specific pricing may apply).
Key notes & references:
- Pricing examples above come from Microsoft Azure official pricing & documentation pages and are region-specific (examples shown for East US / East US 2). Monthly estimates are based on 730 hours/month.
- Capacity Unit definition: 1 CU = 2,500 persistent connections, 1 GB/hr (2.22 Mbps) throughput, 1 compute unit (billing uses the dominant parameter).
Seller details
Microsoft Corporation
Redmond, Washington, United States
1975
Public
https://www.microsoft.com/
https://x.com/Microsoft
https://www.linkedin.com/company/microsoft/
