A DNS name of your own attached to a service. In an Entra tenant it is verified through a TXT or MX record, and every on-premises UPN suffix used to sign in must be one (.local can't be); for App Service it is bound with CNAME or TXT validation.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Custom domain in context, with comparison tables and the common traps.
Terms in this definition
- DNS
The system that turns names into addresses. In Azure, private endpoints depend on private DNS zones, which are queried through 168.63.129.16.
- Tenant
A trusted, dedicated Microsoft Entra ID instance that stores the users, groups and app registrations of one organisation. A subscription trusts only a single tenant, although a tenant can be trusted by several subscriptions.
- MX record
In DNS, this entry names the mail server that accepts a domain's incoming email. Once it targets Microsoft 365, Exchange Online receives every new message for the domain, so set up mailboxes before making the switch.
- UPN
User principal name, the user@domain sign-in name of a user. Only domain suffixes verified in the tenant can be used.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- App Service
Managed PaaS hosting for web apps and Web App for Containers, run in a sandbox without OS access. Deployment slots and autoscale start at the Standard tier.
- CNAME
Alias record in DNS that points one name at another, for example
wwwat<app>.azurewebsites.net; it can't be placed at the apex of a zone.
Related terms
- afdverify
Verification CNAME in Front Door (classic), mapping afdverify.<host> to afdverify.<name>.azurefd.net, which proves ownership of a custom domain while live traffic stays where it is.
- BYOC
Option for HTTPS on a Front Door custom domain in which your own certificate sits in Azure Key Vault, read through a managed identity or registered service principal; direct upload isn't possible and the chain must come from a Microsoft Trusted CA.
- Domain Connect
Lets Microsoft 365 verify a custom domain and set up the required DNS records on its own, once the admin has signed in at a supporting registrar such as Cloudflare, IONOS or GoDaddy.
- Frontend host
In Front Door (classic), the host name, either *.azurefd.net or a custom domain, to which a WAF policy gets linked. Linking it does not filter any traffic by itself.
- MX
A DNS record type that can be used in place of a TXT record to prove you own a custom domain. Set a high priority value on it so that current mail delivery is not affected.