Azure Load Balancer vs Application Gateway: Which to Use?

Azure Load Balancer operates at Layer 4 (TCP/UDP) for high-performance, low-latency traffic distribution. In contrast, Azure Application Gateway operates at Layer 7 (HTTP/HTTPS), offering advanced features like URL-based routing and SSL termination. Choosing between them depends on whether you need simple network-level balancing or intelligent, application-aware traffic management.

What is the fundamental difference between Layer 4 and Layer 7?

When you're studying for the AZ-900, the OSI model is your best friend. The Azure Load Balancer operates at Layer 4 (the Transport Layer). This means it only cares about IP addresses and TCP/UDP ports. It doesn't look at the actual data inside the packet; it just shuffles traffic to the backend pool as fast as possible. It's the 'fast and blind' option.

On the flip side, the Azure Application Gateway operates at Layer 7 (the Application Layer). It is 'application-aware,' meaning it can actually read the HTTP headers and the content of the request. While this adds a tiny bit of latency compared to the Load Balancer, it gives you an incredible amount of control over how traffic is handled. If the exam asks about 'intelligent routing,' your mind should immediately jump to Layer 7.

When should you use URL-based routing?

Imagine you're running a massive e-commerce site. You want users visiting 'contoso.com/images' to go to a pool of servers optimized for static content, while users visiting 'contoso.com/checkout' go to a high-security pool of servers. This is where the Application Gateway shines. Because it operates at Layer 7, it can perform path-based routing based on the URL.

Azure Load Balancer simply cannot do this. It doesn't know what a URL is; it only knows that traffic is coming in on port 80 or 443. If your scenario involves routing traffic based on the content of the request or the specific path requested, the Application Gateway is your only choice. This is a classic AZ-900 trick question—don't let the word 'load balancer' distract you from the 'URL' requirement.

How does SSL termination work in these services?

Handling SSL/TLS certificates can be a nightmare if you have to manage them on every single backend VM. Azure Application Gateway solves this through SSL termination. The gateway decrypts the incoming HTTPS traffic and then passes it to the backend servers as plain HTTP. This offloads the CPU-intensive decryption process from your web servers, allowing them to focus on serving your app.

Azure Load Balancer handles things differently. It uses a 'pass-through' method. It doesn't decrypt the traffic; it just sends the encrypted packets directly to the backend VM, which must then handle the decryption itself. If you see a requirement for 'centralized SSL management' or 'offloading decryption,' you are looking for the Application Gateway.

Is the load balancer regional or global?

Both the Azure Load Balancer and Application Gateway are primarily regional services. They distribute traffic across virtual machines within a specific Azure region. However, it's important to understand the scale. The Azure Load Balancer is designed for ultra-low latency and high throughput within a region, making it ideal for internal database traffic or non-web applications.

If you need to balance traffic across different geographic regions (like US East and North Europe), you'll need to look beyond these two and explore Azure Front Door or Azure Traffic Manager. For the AZ-900, remember that while these tools manage traffic within a region, they are the building blocks that allow your application to scale horizontally across multiple Availability Zones.

Which one is better for non-HTTP traffic?

Not everything on the internet is a website. If you're running a SQL server, a gaming backend, or a custom TCP/UDP application, the Application Gateway is useless because it only speaks HTTP, HTTPS, and WebSockets. In these cases, the Azure Load Balancer is the undisputed champion. It provides the raw performance needed for any TCP or UDP traffic without the overhead of application-layer inspection.

In a real-world architecture, you'll often see both used together. An Application Gateway might handle the public-facing web traffic (Layer 7), and then pass that traffic to an internal Azure Load Balancer (Layer 4) that distributes it across a tier of backend application servers. This 'layered' approach is a hallmark of a well-architected Azure environment.

How can you master these concepts for the AZ-900 exam?

Reading the documentation is a start, but the AZ-900 exam tests your ability to choose the right tool for a specific scenario. You need to be able to spot the keywords—like 'URL path,' 'TCP/UDP,' or 'SSL offloading'—and instantly map them to the correct service. This is where active recall and practice are non-negotiable.

To help you nail this, we offer 1,000 expert-curated Microsoft Azure Fundamentals (AZ-900) practice questions. We don't just give you the right answer; we provide detailed expert reasoning for every single question so you understand the 'why' behind the 'what.' Plus, our domain-level analytics will show you exactly where you're struggling, whether it's in 'Azure Architecture' or 'Governance,' so you can stop wasting time on what you already know.

❓ Frequently Asked Questions