Azure Front Door enables hybrid post-quantum TLS 1.3 at the edge
Azure Front Door now enables hybrid post-quantum key establishment by default for inbound TLS 1.3.
Supported clients can negotiate groups combining classical elliptic-curve exchange with standardized ML-KEM; configurable classical fallback maintains compatibility.
Protection currently covers the client-to-Front Door connection. The separate connection from Front Door to Azure services is a later engineering phase, so this is not a claim of end-to-end post-quantum coverage.
Customers can configure managed or custom TLS policies to balance compatibility and security. Microsoft positions the update as reducing the risk of traffic being captured now for later decryption.
Partner briefing
- What it is
Hybrid post-quantum protection for Front Door ingress.
- What’s changing
Inbound TLS 1.3 supports hybrid ML-KEM groups by default.
- Why it matters
Adds long-term confidentiality protection while retaining configurable compatibility.
- Who it affects
Azure application architects, security teams and implementation partners.