First of all - the kind of CDN setup you need entirely depends on your requirements and solution. To begin with, the options that you have with what can be "CDN-ed" are as follows:
Usually, if you have a public website, it will be good enough that you have one CDN with origin of WebApp service, then the whole website gets CDN-ed and you might opt for rewriting the URL-s to bundled CSS/JS as well as images to point to CDN instead of original path https://azure.microsoft.com/en-us/documentation/articles/cdn-websites-with-cdn/.
However, if you need a fast Intranet, this is not the approach you'd opt for. For CSS/js, that is just fine (in most cases *). However, for images, you have to select a new CDN with blob storage as source. This blob container has to be public! So, you will need to sync this with the business requirements of your client. These are some of the questions that you might want to ask:
If latency is not critical, you might not need to use CDN, give it some testing first. Obviously, if images are highly classifying, CDN is not a good choice either. However, any looser requirement is probably fine, optionally with some extra development - if there are images that should still be protected, ImageFile could be expanded with IsProtected and while rendering, a standard Episerver URL would be rendered instead of a CDN version. The CDN URL for the has a format of https://*.vo.msecnd.net/container-name/folderguid/fileguid.png. Similar format is for the blob storage URL (without any Episerver rewriting): https://*.blob.core.windows.net/container-name/folderguid/fileguid.png. Clearly, if user gets either of these URL-s, they will be available outside of organization and Episerver will not kick in for any access rights. However, if you render a standard URL (ex. /globalassets/wonderfulimage.png), Epi will kick in and you are safe to a reasonable extent. Access rights are also needed in edit mode.
In any case, general CDN module that subscribes to CreatedVirtualPath event is readily available https://github.com/bjuris/EPiServer.CdnSupport/, here is a small modification for Azure, including the modification for some protected images.
* For CSS/js, everything would work splendid with WebApp approach, UNLESS you have non-standard fonts that you want to CDN as well. In the next blogpost, I'll deal with this topic.