Skip to main content

Configuring Azure Front Door and Enforcing Public Access Restrictions on Umbraco Cloud

Placing Azure Front Door (AFD) before Umbraco Cloud can break standard hostname or ACME validation. Forcing traffic through AFD by locking down direct URL access requires IP whitelisting instead of shared secrets due to platform limits.

Written by Joana Knobbe

Product or Service: Umbraco Cloud

Version: All versions

When placing a reverse proxy or CDN like Azure Front Door (AFD) in front of an Umbraco Cloud project, standard hostname validation can fail because the required CNAME verification or ACME challenge paths are blocked or unreadable. Additionally, locking down direct access to the underlying Umbraco Cloud URL to force all traffic through Front Door requires specific IP whitelisting configurations rather than shared secret headers due to platform limitations.

Issue: Users are unable to successfully add and validate a custom hostname on Umbraco Cloud when utilizing Azure Front Door. The URL traffic does not pass through correctly, and attempts to restrict direct access to the default .umbraco.io URL using the documented "shared secret header" basic authentication trick fail to execute properly on the cloud environment.

Solution: To successfully route traffic through Azure Front Door and secure your Umbraco Cloud environment from direct public access, use the following architectural guidelines:
​

1. Hostname Routing Workaround

Because standard Hostname Pre-Validation paths (such as the /.well-known/acme-challenge/ token used for Let's Encrypt certificates managed by Umbraco) can become inaccessible when Azure Front Door is handling SSL certificates externally, standard validation may fail.

  • Configure Azure Front Door to proxy traffic directly to the internal Umbraco Cloud hostname (the default .umbraco.io address assigned to your environment).

  • For multi-site setups where domain-level routing breaks behind the proxy, utilize path-based routing rules within Azure Front Door instead.

2. Restricting Direct Access via Public Access Settings

If your goal is to block users from bypassing Azure Front Door and accessing the backend .umbraco.io URL directly, the standard Umbraco Cloud documentation regarding header-based shared secrets (X-Umbraco-Shared-Secret) cannot be fully customized in this manner on the live platform due to underlying platform prefix restrictions. Instead, use IP Whitelisting:

  • Log into the Umbraco Cloud Portal.

  • Navigate to your project environment and go to Settings > Public Access.

  • Enable Basic Authentication / Public Access Restrictons.

  • Add the Static Egress IP addresses or IP ranges belonging to your Azure Front Door instance to the whitelist.

  • Save the configuration. This ensures only traffic routed natively through your specific Azure Front Door infrastructure can reach the site, while direct hits to the raw Umbraco Cloud URL from untrusted IPs are blocked.

Article last update date: 16-06-2026

Did this answer your question?