← deemwar engineering examples Runnable · Node · zero deps · free · no credentials

The Front Door (classic) migration moves your profile. It does not move your logs, your WAF governance, or your price.

Microsoft's migration tool is one-way and reports success when the new profile exists. This page is about what is not in that new profile, what it now costs, and the second deadline most migration plans do not have on them.

The dates

What is not carried over

Two source classes, never blurred: Microsoft's docs are authoritative; Microsoft Q&A reports are real, dated and linked, but not vendor-confirmed, and they are labelled that way.

From Microsoft's published docs

The tier trap

Reported on Microsoft Q&A, not confirmed by Microsoft

Check your own profiles

Zero dependencies. It never asks for, stores or transmits a credential: you export with your own az login, and nothing leaves your machine.

az network front-door show -g <rg> -n <name> -o json > fd-<name>.json
az network front-door waf-policy show -g <rg> -n <policy> -o json > waf-<policy>.json

node check.js fd-*.json --waf waf-*.json
node check.js --demo          # the shape of the answer, no data needed
$ node check.js --demo Azure Front Door (classic) -> Standard/Premium: what will not survive. Classic retires 2027-03-31. Endpoint cutover deadline 2028-03-31. [DEMO DATA] PROFILE shop-prod -> Premium, forced (WAF "shopwaf" uses managed rule sets) Premium cannot be downgraded to Standard after migration. △ WAF www.example.com: policy "shopwaf" must be recreated if you migrate with CLI/API/Terraform. △ CERT www.example.com: your own Key Vault certificate; grant Key Vault access to a managed identity. ✗ HOST shop-prod.azurefd.net: classic hostname; anything pointing here must move by 2028-03-31. △ RULES rules engine "headers" (2 rules): gets a default name; anything referencing it breaks. △ ROUTE 1 redirect route (http-to-https) recreated as urlRedirectMigrated. PROFILE docs-prod -> Standard (no managed WAF rules found) BASE FEES AFTER A 1:1 MIGRATION: 1 x Premium ($330) + 1 x Standard ($35) = $365/month, before traffic.
check.js rules.js (every rule cited) Send us your checker output

The part nobody checks

A migration is marked done when the new profile exists. That proves the resource is there, not that it serves. After cutover, request every route on the new endpoint and prove three things for each: it answers from the right origin, it presents the right certificate, and the WAF gives the verdict you expect. Then find every place that still names the classic hostname, before April 2028 finds it for you.

If you would rather not do it yourself

We take this on as fixed scope. We will say plainly that you would be among our first customers for this particular engagement. What we bring is the breakage map above and a hard habit of proving that traffic still flows rather than assuming it.