Written by ReadMeFeed Assistant using AI. Verify commands and assumptions for your environment; report anything that needs correction.
Learn how to diagnose and fix Azure Front Door 502 Bad Gateway errors caused by App Service instance replacement during maintenance, with verification steps and Well‑Architected alignment.
13 Sept 2026, 09:20 UTC
When Azure Front Door returns 502 Bad Gateway errors to a Docker Container webapp, the most common cause is a brief gap during App Service instance replacement caused by automated updates or maintenance. During that gap the old instance is terminated and the new instance is not yet ready, so Front Door cannot reach the origin and returns 502.
Azure App Service performs automated updates and maintenance on instances in your plan. When an instance is replaced, there is a short period where the old instance is gone and the new instance is not yet ready. During that gap, Front Door cannot reach the origin and returns 502.
Requests do not reach the origin because there is briefly no instance to receive them. Retries succeed within the same second because the replacement instance has already come online.
Run a Kusto query to isolate 502 errors and examine the errorInfo_s field.
AzureDiagnostics
| where Category == "FrontDoorAccessLog"
| where httpStatusCode_s == "502"
| summarize count() by errorInfo_s, bin(TimeGenerated, 5m)
| render timechartLook for spikes that coincide with known maintenance windows.
In the Azure portal, navigate to Service Health → Health advisories and filter for App Service maintenance in the region of your webapp (e.g., East US 2). If an advisory overlaps the 502 spikes, this strongly indicates the instance‑replacement cause.
If the spikes show OriginConnectionRefused or OriginConnectionAborted with a very short timeTaken, this matches the instance‑replacement theory.
It would also help to post the errorInfo_s values from your query. OriginConnectionRefused or OriginConnectionAborted with a very short timeTaken fits the instance replacement theory.
Rerun the query with a 5‑ to 15‑minute bin size and compare the timestamps to the exact maintenance advisory times.
To confirm this, rerun your 502 chart with a smaller bin size, such as 5 to 15 minutes, and compare it to the exact timestamps of the App Maintenance advisory.
If the 502 spikes fall inside that window, that is strong evidence.
Scale the App Service plan to at least two instances. With multiple instances, the platform can take one out of rotation for updates without interrupting traffic.
If this is the cause, the fix is simple. Scale your App Service plan to at least two instances.
If you are on a Premium plan, consider enabling zone redundancy for additional protection.
If you are on a Premium plan, enabling zone redundancy adds another layer of protection.
If errorInfo_s shows OriginConnectionAborted but the timing does not match the maintenance window, the issue may be Front Door reusing a pooled connection when the origin closes it. In that case:
Sometimes Front Door reuses a pooled connection at the same moment the origin closes it, which produces a fast 502 with no logs on the origin. If your errorInfo_s values show OriginConnectionAborted and the timing does not match the maintenance window, try disabling HTTP/2 between Front Door and the origin and check your Origin Response Timeout setting.
After scaling, monitor the same Kusto query for at least 24 hours. The count of 502 errors should drop to zero or near‑zero during maintenance windows. Confirm that health probes succeed continuously and that no new OriginConnectionRefused or OriginConnectionAborted spikes appear.
If scaling introduces unexpected cost, you can revert to the previous instance count. Because the change is purely configuration‑based, there is no data loss or downtime required to scale back.
This troubleshooting process aligns with the Reliability, Performance Efficiency, and Operational Excellence pillars:
Reliability Ensures that the workload meets the uptime and recovery targets by building redundancy and resiliency at scale.
Performance Efficiency Adjust to changes in demands placed on the workload by through horizontal scaling and testing changes before deploying to production.
Operational Excellence Reduce issues in production by building holistic observability and automated systems.
Using reference architectures from the Azure Architecture Center helps ensure that the solution follows proven patterns for resiliency and observability.
A thoughtful contribution can make all the difference. Be the first to share one.
azure