# Azure CDN (Microsoft.Cdn)

> Azure Content Delivery Network caches static web content at edge locations worldwide. Its management
> API — the Microsoft.Cdn Azure Resource Manager resource provider — creates and operates CDN profiles,
> endpoints, origins, custom domains and WAF policies, and also serves the Azure Front Door Standard and
> Premium resources. IMPORTANT: Azure CDN Standard from Microsoft (classic) is retiring on 2027-09-30
> and stopped accepting new instances in 2025. Microsoft directs new work to Azure Front Door.

Generated by the API Evangelist enrichment pipeline on 2026-09-17 from this repository's artifacts.
method: generated — Microsoft publishes no llms.txt on any host in this record (learn.microsoft.com,
azure.microsoft.com and www.microsoft.com all 404; portal.azure.com returns an HTML shell, recorded in
llms/microsoft-azure-cdn-llms-probe.yml).

## Contract

- [OpenAPI (Swagger 2.0, api-version 2026-07-01)](openapi/microsoft-azure-cdn-management-openapi.json): The contract Microsoft publishes. 73 paths, 115 operations, 387 definitions, 16 tags. Host management.azure.com.
- [As-published archive](openapi/_original/microsoft-azure-cdn-management-openapi.json): verbatim copy harvested from Azure/azure-rest-api-specs.
- [ARM common types](openapi/_original/common-types/resource-management-v6-types.json): the shared document the contract $refs for its error and resource shapes.
- [Request/response examples](examples/_original/): 123 provider-published example documents, one or more per operation, referenced from the contract's x-ms-examples.

## How to call it

- Base URL: `https://management.azure.com`
- Every request requires `api-version=2026-07-01` as a query parameter.
- Auth: `Authorization: Bearer <Microsoft Entra ID token>`, audience `https://management.azure.com/`, scope `https://management.azure.com/.default`.
- [Authentication profile](authentication/microsoft-azure-cdn-authentication.yml)
- [Scopes and Azure RBAC roles](scopes/microsoft-azure-cdn-scopes.yml): CDN Profile Contributor / Reader, CDN Endpoint Contributor / Reader.
- [Conventions](conventions/microsoft-azure-cdn-conventions.yml): pagination, long-running operations, idempotency, dry-run and reversibility.

## Things an agent must know before acting

- 56 of 115 operations are LONG-RUNNING. They return `202 Accepted` with an `Azure-AsyncOperation` or `Location` polling URL. The resource is not in its final state when the call returns.
- There is NO `Idempotency-Key` header. PUT and DELETE are replay-safe by ARM resource semantics (30 operations); the 45 action POSTs and PATCHes — purge, load, start, stop, migrate, upgrade — are not.
- `Profiles_Delete` cascades to every endpoint, origin and custom domain under the profile and has no restore path.
- The migration to Azure Front Door is reversible: `Profiles_Migrate` can be undone with `Profiles_MigrationAbort` at any point before `Profiles_MigrationCommit`.
- Throttling is a token bucket: 250 reads / 200 writes / 200 deletes per subscription per region, refilling at 25 / 10 / 10 per second. On exhaustion you get `429` with `Retry-After`. Watch `x-ms-ratelimit-remaining-subscription-reads|writes|deletes`.
- Errors are NOT RFC 9457. The envelope is `{"error": {"code","message","target","details","additionalInfo"}}`.

## Resource model

- [Data model](data-model/microsoft-azure-cdn-data-model.yml)
- Root: `Profile`. Its SKU decides which of two families it belongs to.
- Classic CDN family: Profile > Endpoint > Origin, OriginGroup, CustomDomain; plus CdnWebApplicationFirewallPolicy.
- Azure Front Door family: Profile > AFDEndpoint > Route; AFDOriginGroup > AFDOrigin; AFDDomain, RuleSet > Rule, Secret, SecurityPolicy.

## Errors and limits

- [Error catalog](errors/microsoft-azure-cdn-problem-types.yml)
- [Rate limits](rate-limits/microsoft-azure-cdn-rate-limits.yml)

## Clients

- [Packages](packages/microsoft-azure-cdn-packages.yml): @azure/arm-cdn (npm), azure-mgmt-cdn (PyPI), Azure.ResourceManager.Cdn (NuGet), azure-resourcemanager-cdn (Maven), Az.Cdn (PowerShell Gallery). The Go and Ruby clients are years behind the contract — do not treat them as current.
- [CLI](cli/microsoft-azure-cdn-cli.yml): `az cdn` and `az afd` in the Azure CLI; `Az.Cdn` in Azure PowerShell.

## MCP

- [MCP manifest](mcp/microsoft-azure-cdn-mcp.yml): Microsoft serves a live anonymous remote MCP server at `https://learn.microsoft.com/api/mcp` — but it is a DOCUMENTATION server (docs search, code-sample search, page fetch). There is no MCP server for the Microsoft.Cdn management surface; the Azure control-plane MCP server (`@azure/mcp`) ships 32 service areas and CDN is not one of them.
- [Tool crosswalk](mcp/microsoft-azure-cdn-tool-crosswalk.yml): zero of the 3 live MCP tools bind to any of the 115 REST operations.

## Lifecycle, pricing, security

- [Lifecycle and retirement](lifecycle/microsoft-azure-cdn-lifecycle.yml)
- [Plans and pricing](plans/microsoft-azure-cdn-plans-pricing.yml): metered per GB of outbound transfer by geographic zone and volume band. The management API is not separately billed.
- [Conformance](conformance/microsoft-azure-cdn-conformance.yml)
- [Domain security probe](security/microsoft-azure-cdn-domain-security.yml)
- [Vulnerability disclosure](security/microsoft-azure-cdn-vulnerability-disclosure.yml)
- [Well-known documents](well-known/microsoft-azure-cdn-well-known.yml)

## Official documentation

- REST API reference: https://learn.microsoft.com/en-us/rest/api/cdn/
- Product docs (now redirecting to Front Door): https://learn.microsoft.com/en-us/azure/frontdoor/
- Retirement and comparison: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-cdn-comparison
- Pricing: https://azure.microsoft.com/en-us/pricing/details/cdn/
- Status: https://azure.status.microsoft/en-us/status