Azure Front Door is working correctly.
Origin access is protected via Access Restrictions.
Direct App Service access returns HTTP 403.