Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic across global Azure regions, providing high availability and responsive performance for your applications. Because Traffic Manager controls how clients are routed to your service endpoints, securing your Traffic Manager configuration is essential to prevent misrouting, unauthorized changes, and monitoring gaps that could affect application availability.
This article provides security recommendations for Azure Traffic Manager. For an overview of Azure's network security services and how they work together, see What is Azure network security?
The security recommendations in this article implement Zero Trust principles: "Verify explicitly", "Use least privilege access", and "Assume breach". For comprehensive Zero Trust guidance, see the Zero Trust Guidance Center.
Network security
Network security for Traffic Manager focuses on ensuring that health probes can reach your endpoints and that your DNS-based routing configuration prevents unintended traffic patterns. Because Traffic Manager operates at the DNS layer rather than as a proxy, network security focuses on probe access and endpoint configuration.
Allow Traffic Manager health probe traffic through firewalls: For Azure-hosted endpoints, configure network security groups (NSGs) or Azure Firewall rules to permit inbound traffic from Traffic Manager health probes by using the
AzureTrafficManagerservice tag. For non-Azure endpoints, add the published Traffic Manager probe IP ranges to the allow list in the endpoint's firewall. If probes are blocked, Traffic Manager marks endpoints as unhealthy and routes traffic away from otherwise healthy services, causing unexpected outages. For more information, see Traffic Manager endpoint monitoring.Configure endpoint health monitoring over HTTPS for web endpoints: Select HTTPS as the monitoring protocol for web endpoints in your Traffic Manager profile instead of HTTP. Use HTTPS probes to verify endpoints accept HTTPS connections. Probes don't validate certificate validity. For more information, see Traffic Manager endpoint monitoring.
Require TLS 1.2 or later for services that interact with Traffic Manager: Verify that endpoints and other resources that interact with Traffic Manager support TLS 1.2 or later. Traffic Manager support for TLS 1.0 and 1.1 ended on February 28, 2025, and older TLS dependencies can cause service disruptions. For more information, see Traffic Manager FAQ.
Use nested profiles for per-endpoint monitoring settings: Apply different monitoring configurations to individual endpoints by using nested Traffic Manager profiles. A single profile shares monitoring settings across all endpoints, but nesting helps you customize probe paths, intervals, and failure thresholds for each endpoint based on its specific requirements. For more information, see Nested Traffic Manager profiles.
Set appropriate
MinChildEndpointsvalues in nested profiles: Configure theMinChildEndpointsthreshold in nested profiles to control when Traffic Manager considers a child profile healthy. Setting this value too low might route traffic to a degraded region with insufficient capacity. For more information, see Nested Traffic Manager profiles.Use geographic routing for data sovereignty requirements: Apply the geographic routing method to direct DNS queries from mapped regions to specific endpoints when data residency regulations require regional routing boundaries. Because Traffic Manager infers location from the DNS query source IP, typically the local DNS resolver, account for resolver-location limitations in compliance designs. Combine geographic routing with nested profiles to provide failover within the allowed geographic region. For more information, see Traffic Manager routing methods.
Configure a fallback endpoint for subnet routing: When using subnet routing to map source IP address ranges to specific endpoints, define a fallback endpoint with no address range to handle requests from unmapped IP addresses. Without a fallback, Traffic Manager returns a NODATA response for unmatched source addresses. For more information, see Traffic Manager routing methods.
Identity and access management
Identity and access management for Traffic Manager ensures that only authorized users can modify your DNS routing configuration. Unauthorized changes to Traffic Manager profiles can redirect traffic to attacker-controlled endpoints or cause service disruptions.
Assign least-privilege RBAC roles for Traffic Manager management: Grant the Traffic Manager Contributor role to users who manage Traffic Manager profiles and endpoints, and use Reader for view-only access. Separate read-only monitoring access from profile modification permissions to limit the impact of compromised accounts. For more information, see Traffic Manager Contributor.
Grant cross-subscription endpoint access with RBAC: For endpoint types that support cross-subscription configuration, grant the operator configuring the profile read access to the target endpoint resources. Azure Web Apps don't support endpoints from multiple subscriptions when the same custom domain name is used. Without proper cross-subscription permissions for the supported endpoint types, endpoint additions fail. For more information, see Traffic Manager FAQ.
Apply resource locks to prevent accidental deletion: Place
CanNotDeleteresource locks on production Traffic Manager profiles to prevent accidental removal. Deleting a Traffic Manager profile immediately stops DNS-based routing for all associated endpoints, which can cause a full service outage. For more information, see Lock your resources to protect your infrastructure.
Logging and monitoring
Logging and monitoring for Traffic Manager provide visibility into endpoint health, DNS query patterns, and routing behavior. Proactive monitoring helps you detect misconfigurations, endpoint failures, and unexpected traffic shifts before they affect end users.
Enable diagnostic logging for probe health results: Configure diagnostic settings on your Traffic Manager profile to capture probe health result logs. Send these logs to a Log Analytics workspace, Azure Storage, or an event hub for analysis and long-term retention. Probe logs record endpoint health state changes that help you investigate past outages. For more information, see Traffic Manager diagnostic logs.
Configure alerts on endpoint health status metrics: Create Azure Monitor alerts on the Endpoint Status by Endpoint metric to detect when endpoints become unhealthy. Set the alert threshold so that the average status drops below 0.5, which indicates that more than half of the health probes are failing. Multiple probes from different locations check each endpoint, so a single probe failure doesn't necessarily indicate an outage. For more information, see Traffic Manager metrics and alerts.
Monitor DNS query volume per endpoint: Track the Queries by Endpoint Returned metric to identify unexpected shifts in traffic distribution that could indicate a routing misconfiguration or endpoint failure. A sudden increase in queries to a secondary endpoint might signal that the primary endpoint is degraded. For more information, see Traffic Manager metrics and alerts.
Investigate degraded profile status promptly: When your Traffic Manager profile status shows Degraded, one or more endpoints are unhealthy. Investigate immediately because degraded status means Traffic Manager might be routing traffic to remaining healthy endpoints, which could become overloaded. For more information, see Troubleshoot Azure Traffic Manager degraded status.
Compliance and governance
Compliance and governance for Traffic Manager help you enforce organizational standards across your DNS routing infrastructure. Consistent policy enforcement prevents configuration drift that could introduce security gaps.
Use Azure Policy to audit Traffic Manager configurations: Assign built-in Azure Policy definitions to enforce diagnostic logging across your Traffic Manager profiles. The three built-in definitions for Traffic Manager - Enable logging by category group for Traffic Manager profiles to Log Analytics, to Event Hub, and to Storage - automatically deploy diagnostic settings that capture probe health results and DNS query data. Policy assignments provide continuous compliance visibility and flag profiles that don't meet your security baseline. For more information, see Azure Policy built-in definitions.
Validate endpoint health monitoring configuration across profiles: Regularly audit all Traffic Manager profiles to confirm that health monitoring uses the appropriate protocol (HTTPS for web endpoints when possible), appropriate probe intervals, and correct probe paths. Inconsistent monitoring settings across profiles can lead to delayed failover or false-positive health checks. For more information, see Traffic Manager endpoint monitoring.
Backup and recovery
Backup and recovery for Traffic Manager ensure that your DNS-based routing remains functional during regional outages and service disruptions. Because Traffic Manager itself is a globally available service, recovery planning focuses on endpoint redundancy and profile resilience.
Configure multiple endpoints across regions for failover: Add endpoints in at least two Azure regions to each Traffic Manager profile so that traffic automatically routes to a healthy region when one region experiences an outage. Use the priority routing method to define a clear failover order. For more information, see Traffic Manager routing methods.
Use nested profiles for granular regional failover: Combine an outer profile using priority or performance routing with inner profiles that use weighted or performance routing within each region. This structure provides both cross-region failover and in-region load distribution, improving resilience against partial regional failures. For more information, see Nested Traffic Manager profiles.
Set DNS TTL values appropriate for your failover requirements: Configure the DNS time-to-live (TTL) value to balance failover speed against DNS query volume. A lower TTL (such as 30 seconds) enables faster failover but increases DNS query traffic and cost, while a higher TTL reduces queries but delays client redirection away from failed endpoints. For more information, see Traffic Manager FAQs.
Test failover behavior regularly: Periodically disable endpoints in your Traffic Manager profile to verify that failover routing works as expected and that monitoring alerts fire correctly. Untested failover configurations might not behave as designed during a real outage. For more information, see Traffic Manager endpoints.