Azure CDN Profiles and Rules Engine

Azure Content Delivery Network (CDN) is a globally distributed network of proxy servers (edge nodes) that cache content from your origin servers (e.g., Azure Web App, Azure Storage, or any public web server). Its primary purpose is to reduce latency for end users by serving content from a location geographically closer to them. Without CDN, every request from a user in Tokyo would have to travel to your origin server in Virginia, incurring high latency (200-300ms). With CDN, the request is routed to the nearest edge node—perhaps in Tokyo or Osaka—which can serve cached content in under 10ms.

Azure CDN is not a single product; it offers multiple tiers: Azure CDN Standard from Microsoft, Azure CDN Standard from Akamai, and Azure CDN Premium from Verizon. The AZ-104 exam focuses primarily on the Microsoft and Akamai tiers, with some questions on Verizon. The key difference is that the Premium tier (Verizon) provides a more advanced Rules Engine with additional features like device filtering and token authentication, while Standard tiers have a simpler rules engine. For the exam, you must know the capabilities of each tier and when to use which.

When a user requests a resource (e.g., https://<your-cdn-endpoint>.azureedge.net/images/logo.png), the following steps occur:

- Caching Rules: - Default TTL: If the origin does not provide Cache-Control or Expires headers, the default TTL is 7 days for Microsoft CDN, 7 days for Akamai, and 7 days for Verizon. However, for dynamic content (e.g., files with specific extensions), the default may differ. - Cache Behavior Settings: You can set caching rules per endpoint: Ignore query strings (cache one version regardless of query string), Bypass caching (never cache), or Override (set custom TTL). - Rules Engine: Allows fine-grained control based on conditions like URL path, file extension, request header, etc. Actions include cache expiration, compression, redirect, and response header modification.

To create a CDN profile and endpoint via Azure CLI:

# Create a resource group
az group create --name MyCDNResourceGroup --location eastus

# Create a CDN profile (Standard Microsoft tier)
az cdn profile create \
  --name MyCDNProfile \
  --resource-group MyCDNResourceGroup \
  --sku Standard_Microsoft

# Create a CDN endpoint
az cdn endpoint create \
  --name MyCDNEndpoint \
  --profile-name MyCDNProfile \
  --resource-group MyCDNResourceGroup \
  --origin www.contoso.com \
  --origin-host-header www.contoso.com

To verify CDN endpoint and test caching:

# List endpoints
az cdn endpoint list --profile-name MyCDNProfile --resource-group MyCDNResourceGroup

# Purge cache (force re-fetch)
az cdn endpoint purge \
  --content-paths '/images/*' \
  --name MyCDNEndpoint \
  --profile-name MyCDNProfile \
  --resource-group MyCDNResourceGroup

# Test with curl
curl -I https://myendpoint.azureedge.net/images/logo.png
# Look for X-Cache header: HIT, MISS, or TCP_HIT

The Rules Engine is a feature available in Azure CDN Standard from Microsoft (limited) and Premium from Verizon (full). It allows you to define conditions and actions to customize how requests are handled at the edge.

Conditions:

Actions:

How Rules Engine Works:

Example Rule: Redirect all requests for /old-blog/* to https://newblog.contoso.com/

{
  "rules": [
    {
      "name": "Redirect old blog",
      "conditions": [
        {
          "name": "UrlPath",
          "parameters": {
            "operator": "BeginsWith",
            "matchValues": ["/old-blog/"]
          }
        }
      ],
      "actions": [
        {
          "name": "UrlRedirect",
          "parameters": {
            "redirectType": "Found (302)",
            "destinationProtocol": "https",
            "destinationPath": "/",
            "destinationHostname": "newblog.contoso.com"
          }
        }
      ]
    }
  ]
}

A large e-commerce company hosts its product images and static assets (CSS, JS) on Azure Blob Storage. Their web application runs on Azure App Service in West US. Users in Europe and Asia experience slow load times (3-5 seconds). They deploy Azure CDN Standard Microsoft with a profile named 'ecommerce-cdn'. They create an endpoint pointing to the storage account's static website URL. They configure caching rules to ignore query strings (since product image URLs are immutable) and set a default TTL of 7 days. For dynamic product pages (e.g., /product/123), they use the Rules Engine to bypass caching entirely, as these pages are personalized. After deployment, load times drop to under 200ms globally. The cache hit ratio stabilizes at 95%. However, during a flash sale, traffic spikes cause origin load to increase. They preload popular images using the 'Preload' feature (Verizon Premium) to warm the cache. They also enable compression for text files, reducing bandwidth by 40%.

A media company streams video on demand (VOD) using Azure CDN. They use Azure CDN Premium from Verizon for advanced features like token authentication to prevent hotlinking. They configure a rule that requires a valid token in the query string for all video files (*.mp4). Without the token, the CDN returns a 403. They also use device filtering to serve different video resolutions based on User-Agent (e.g., mobile gets 480p, desktop gets 1080p). The Rules Engine handles this: condition on User-Agent, action to rewrite the URL to point to a different folder (e.g., /videos/480p/ vs /videos/1080p/). They set cache TTL for video files to 1 hour because content updates frequently. During a major event, they purge old content and preload new videos. A misconfiguration in the token validation rule causes legitimate users to receive 403 errors; they quickly disable the rule, fix the token logic, and re-enable.

A SaaS provider delivers a JavaScript-based single-page application (SPA) globally. The SPA is hosted on Azure Storage static website. They use Azure CDN Standard Microsoft with custom domain 'app.contoso.com'. They enable HTTPS with a CDN-managed certificate. The SPA makes API calls to a separate API server (api.contoso.com). They configure the CDN to proxy API calls? No—CDN is for static content. Instead, they use Azure Front Door for the API with WAF. For the static SPA, they set cache TTL to 1 year because the SPA is versioned (e.g., app.contoso.com/1.0.0/index.html). They use URL redirect rules to redirect root to the latest version. They also add CORS headers via Rules Engine to allow cross-origin requests from the API domain. A common mistake is caching the SPA's index.html without versioning, causing users to get stale JavaScript after a new release. They avoid this by using versioned URLs and purging only the old version.