This message was deleted.

Ended up using

EndpointCustomDomain

from Azure Classic.

var customDomain = new Pulumi.Azure.Cdn.EndpointCustomDomain(
                    // Name + 7 random chars can be max 24 
                    $"frontend-domain", new()
                    {
                        CdnEndpointId = endpoint.Id,
                        HostName = customDomainString,
                        CdnManagedHttps = new EndpointCustomDomainCdnManagedHttpsArgs()
                        {
                            ProtocolType = "ServerNameIndication",
                            CertificateType = "Dedicated",
                        }
                    },
                    new CustomResourceOptions()
                    {
                        DependsOn = dnsRecord
                    });