Unpack AFD Origin Group

Splits a shared Azure Front Door (Standard/Premium) origin group — one that is used by multiple routes — into individual origin groups, one per route. Each new origin group is an exact clone of the source (same origins, load balancing, health probe, session affinity, etc.) but is not associated to any route. Route reassignment is done manually afterwards.

The source origin group is never modified.

Prerequisites

Requirement	Details
PowerShell	7.0 or later
Az.Cdn module	≥ 6.0.0 — Install-Module Az.Cdn (included in Az meta-module)
Az.Resources module	≥ 9.0.0 — Install-Module Az.Resources (included in Az meta-module)
Azure authentication	Connect-AzAccount before running the script
Permissions	Contributor (or equivalent) on the AFD profile resource group

Keep modules up to date. The script checks PSGallery at startup and warns if newer module versions are available. Older SDK versions may not expose properties introduced in recent API versions, which could lead to incomplete origin group cloning.

How It Works

The script uses an ARM template deployment to create all origin groups and origins in a single parallel operation:

1. Validates that the profile, endpoint, and source origin group exist.
2. Reads the source origin group configuration and all its origins.
3. Discovers routes that reference the source origin group.
4. Checks for naming conflicts with existing origin groups (informational — ARM Incremental is idempotent).
5. Builds an ARM template containing all new origin groups and origins as resources.
6. Deploys the template in Incremental mode via New-AzResourceGroupDeployment.

This approach is significantly faster than sequential API calls because ARM deploys independent resources in parallel.

Parameters

Parameter	Type	Required	Description
-ProfileName	string	Yes	Name of the Azure Front Door profile
-ResourceGroupName	string	Yes	Resource group containing the AFD profile
-EndpointName	string	Yes	Short name of the endpoint (not the FQDN)
-OriginGroupName	string	Yes	Name of the source origin group to unpack
-WhatIf	switch	No	Uses ARM What-If to preview planned changes without deploying
-Confirm	switch	No	Prompt for confirmation before deploying

Naming Convention

New origin groups are named og-<route-name>, with the -route suffix stripped if present:

Route Name	New Origin Group Name
app-frontend-route	og-app-frontend
api-backend-route	og-api-backend
my-custom-route-name	og-my-custom-route-name

What Gets Cloned

Origin Group Settings

• Load balancing (additional latency, sample size, successful samples required)
• Session affinity state
• Health probe (path, protocol, interval, request type) — if configured
• Traffic restoration time to healed/new endpoints
• Authentication type and scope
• User-assigned identity ID

Origin Settings (per origin)

• Host name, HTTP port, HTTPS port
• Priority, weight, enabled state
• Certificate name check enforcement
• Origin host header
• Private link configuration (ID, resource group, location, request message)
• Azure origin ID

Usage

Dry Run (recommended first step)

.\unpack-afdorigingroup.ps1 `
    -ProfileName my-afd-profile `
    -ResourceGroupName my-resource-group `
    -EndpointName my-endpoint `
    -OriginGroupName my-shared-origin-group `
    -WhatIf

This shows which origin groups would be created without making any changes.

Execute

.\unpack-afdorigingroup.ps1 `
    -ProfileName my-afd-profile `
    -ResourceGroupName my-resource-group `
    -EndpointName my-endpoint `
    -OriginGroupName my-shared-origin-group

Re-run (idempotent)

The script uses ARM Incremental mode, which is idempotent. Re-running is safe — existing origin groups will be updated to match the source configuration.

Post-Execution Steps

1. Verify the new origin groups in the Azure portal or with:

   Get-AzFrontDoorCdnOriginGroup -ProfileName <profile> -ResourceGroupName <rg> |
       Where-Object { $_.Name -like 'og-*' } |
       Select-Object Name

2. Manually update each route to point to its new dedicated origin group.
3. Remove the original shared origin group once all routes are reassigned.

Error Handling

• The script uses strict mode and stops at the first error.
• Input validation checks that the profile, endpoint, and origin group exist before proceeding.
• If a target origin group already exists, ARM Incremental mode updates it in-place (idempotent).