Separate Front-End to Back-End
In this moment the role is in the same server and this is not "awesome" for security, in particular when the work folders use the same production file server.
another scenario is when there's only one Public IP.
The feedback is have two roles: front-end and back-end to separate publishing from sourcing.
This request has been developed for private testing. please email me jianyan at microsoft for engagement.