The booking portal of Nordlicht Reisen GmbH, a fictional travel agency, runs on several virtual machines (lesson 3.5). Visitors should know only one address, and if a machine fails, the traffic must go to the others. The database tier behind it should also run on two machines, but be reachable only from within the network. Azure Load Balancer does both: a public one for the visitors, an internal one for the application tier. The exam calls this configure an internal or public load balancer.
Prior knowledge: What load balancers are for and how layer 4 and layer 7 differ is explained in K3, lesson 3.0.5. Public IP addresses and subnets are lesson 4.1, network security groups lesson 4.3, zones and scale sets lesson 3.5. Application Gateway (layer 7, understands HTTP) and Azure Front Door are separate services and are not on the skills list; this lesson covers load balancers only.
What Azure Load Balancer is
Azure Load Balancer works at layer 4 (transport, TCP and UDP). It is the single point of contact for clients and distributes connections ("flows") that arrive at its frontend across the instances in the backend pool, according to rules and the results of the health probes. The instances are virtual machines or scale sets.
Two kinds, by the kind of frontend:
| Public load balancer | Internal (private) load balancer | |
|---|---|---|
| Frontend | public IP address | private IP address from a subnet |
| Traffic | from the internet to your VMs; also outbound (translation of private to public addresses) | within the virtual network, from peered networks, and from the on-premises network over VPN or ExpressRoute |
| Nordlicht example | visitors of the booking portal | web tier → database tier |
The tiers (SKUs): Standard and Gateway. Microsoft retired the Basic tier on September 30, 2025, and it is no longer to be used for new deployments; existing Basic load balancers keep running but are unsupported and not covered by any SLA (source: Microsoft Learn, "Azure Load Balancer SKUs" and "What's new in Azure Load Balancer", as of 11/12/2026). The Gateway tier has a special purpose and is not on the skills list. So you create Standard load balancers. What sets Standard apart:
- Secure by default: Standard load balancers and Standard IP addresses are closed for inbound connections until a network security group explicitly allows the traffic. If there is no NSG on the subnet and the network interface, the traffic is blocked. The VMs in the backend pool therefore need an NSG (lesson 4.3).
- Support for availability zones: zone-redundant or zonal frontends, for inbound and outbound traffic.
- Health probes with TCP, HTTP, and HTTPS.
- For Standard, Microsoft states an SLA of 99.99 percent; the terms are in Microsoft's SLA text.
- The Standard load balancer needs a public IP address of the Standard tier.