Explanation: DNS: CNAME (When you added a custom domain to your Front Door's frontend hosts, you created a CNAME record in the DNS table of your domain registrar to map it to your Front Door's default .azurefd.net hostname) Store certificate in: KeyVault1 (Your key vault must be configured to use the Key Vault access policy permission model.) There you have a link with all explained https://learn.microsoft.com/en-us/azure/frontdoor/front- door-custom-domain-https.