Azure Load Balancer — Types and SKUs

Azure Basics · Network Traffic – Routing, Private Link, Load Balancer, Application Gateway · Lesson 3 of 5

Load Balancer is an L4 (TCP/UDP) balancer; a public LB takes Internet traffic, an internal LB works only inside the VNet; only the Standard SKU is used now (closed by default, zone support, SLA).

Azure Load Balancer distributes L4 (TCP/UDP) traffic from a frontend to a backend pool based on rules and health probes. It does not read URLs or HTTP headers.

Type	Frontend	Used for
Public	Public IP	Takes Internet traffic and maps public IP:port → VM private IP:port; also provides outbound
Internal	Private IP in the VNet	Traffic inside the VNet or from on-prem over VPN: the app tier behind the web tier, internal apps

flowchart LR
  I["Internet"] --> PLB["Public LB (Standard)"]
  PLB --> W1["web-01"]
  PLB --> W2["web-02"]
  W1 --> ILB["Internal LB 10.10.2.100"]
  W2 --> ILB
  ILB --> A1["app-01"]
  ILB --> A2["app-02"]

	Basic (retired 30 Sep 2025)	Standard
Backend	Up to 300 instances, one availability set/scale set	Up to 1000 instances, any VM in one VNet
Health probes	TCP, HTTP	TCP, HTTP, HTTPS
Availability zones	No	Zone-redundant or zonal
Security	Open by default	Closed by default: an NSG must allow traffic
SLA	None	99.99%

Traps: Standard LB is secure by default — VMs behind it need an NSG allowing the service port; for URL-based routing use Application Gateway (L7), not Load Balancer.

Command	Meaning
`az network lb create -g rg-devops-lab -n lb-web --sku Standard --public-ip-address pip-lb --frontend-ip-name fe-web --backend-pool-name be-web`	Standard public LB
`az network lb list -g rg-devops-lab -o table`	List load balancers

Choosing a load-balancing service

Azure has four main options, split by layer and by reach:

Service	Layer	Reach	Typical use
Load Balancer	L4 TCP/UDP	Regional	VMs and scale sets, any protocol
Application Gateway	L7 HTTP/S	Regional	Web apps needing path routing, TLS offload, WAF
Front Door	L7 HTTP/S	Global	Global web entry with edge caching and WAF
Traffic Manager	DNS	Global	Steer users to the closest or healthy region by DNS answer

Global services usually sit in front of regional ones: Front Door or Traffic Manager chooses a region, then a regional load balancer or gateway chooses a server. Traffic Manager only answers DNS queries, so clients connect straight to the endpoint and failover speed depends on DNS TTL.

More Load Balancer variants

A cross-region (global) load balancer gives one static anycast IP in front of regional Standard load balancers.
A Gateway Load Balancer chains third-party network appliances transparently into the traffic path of another load balancer or VM.
A frontend can be zone-redundant (survives a zone failure) or zonal (pinned to one zone for predictable latency).

How you pay

Standard Load Balancer is billed by the number of configured rules and by data processed, while an internal load balancer with no rules costs nothing. Inbound NAT rules do not count toward the rule total.

Migrating from Basic

Basic Load Balancer is retired. Microsoft provides a PowerShell module (AzureBasicLoadBalancerUpgrade) that upgrades a Basic load balancer and its public IPs to Standard, but plan for a short outage and for the new NSG requirement, because Standard rejects traffic until an NSG allows it.