Azure Front Door uses three service tags to manage the traffic between your clients and your origins:
The AzureFrontDoor.Backend service tag contains the IP addresses that Front Door uses to access your origins. You can apply this service tag when you configure security for your origins.
The AzureFrontDoor.Frontend service tag contains the IP addresses that clients use to reach Front Door. You can apply the AzureFrontDoor.Frontend service tag when you want to control the outbound traffic that can connect to services behind Azure Front Door.
The AzureFrontDoor.FirstParty service tag is for internal use within Azure.
For more information on Azure Front Door service tags scenarios, see available service tags.