Azure DDoS Protection

About Azure DDoS Protection

Azure DDoS Protection is Microsoft's managed network-layer defense for Azure workloads exposed through eligible public IP resources. It is designed to detect and automatically mitigate volumetric and protocol attacks at network layers 3 and 4, while application-layer attacks still require controls such as a web application firewall. The service is most relevant to organizations running internet-facing Azure workloads that need stronger protection than the platform's default infrastructure-level DDoS defenses.

What does Azure DDoS Protection protect?

Azure DDoS Protection monitors traffic patterns for eligible Azure public endpoints and automatically applies mitigation when an attack exceeds the learned thresholds for a protected resource. Microsoft currently documents always-on traffic monitoring, adaptive tuning, attack analytics, metrics, alerts and automatic mitigation for supported layer 3 and layer 4 attack vectors.

The service is not a replacement for application-layer security. Microsoft explicitly recommends combining DDoS Protection with a web application firewall for web workloads because WAF products address layer 7 threats while DDoS Protection focuses on network-layer volumetric and protocol attacks.

What is the difference between DDoS Network Protection and IP Protection?

Microsoft currently offers two paid protection models. DDoS Network Protection is enabled at the virtual network level through a DDoS protection plan. Eligible public IP resources in protected virtual networks receive the enhanced protection features, and one plan can cover subscriptions across the same tenant.

DDoS IP Protection is enabled directly on an eligible public IP resource and uses a pay-per-protected-IP model. It includes the same core mitigation engineering but does not include DDoS Rapid Response, cost protection or Web Application Firewall discounts. Microsoft also states that Basic-tier public IP protection is unavailable with DDoS IP Protection but is available with Network Protection.

How does Azure DDoS Protection pricing work?

Pricing was checked on September 3, 2026. Microsoft currently prices DDoS Network Protection as a fixed monthly plan that includes protection for up to 100 public IP resources, with additional protected resources billed separately. DDoS IP Protection is billed per protected public IP resource. Microsoft's current public pricing page lists IP Protection at $199 per protected public IP per month, based on 730 hours per month.

Microsoft's pricing guidance says IP Protection is generally more economical when protecting fewer than 15 public IP resources, while Network Protection becomes more economical above that point and includes additional benefits. Network Protection also includes WAF discounts for qualifying Application Gateway deployments and cost protection for eligible scale-out costs caused by a documented DDoS attack. Actual charges can vary by agreement, region and billing context.

What is the new DDoS custom policy preview?

Microsoft added Azure DDoS Protection custom policy as a preview capability in 2026 for organizations that need more control than adaptive auto-tuning provides. A custom policy can set fixed inbound detection thresholds for TCP, UDP and TCP SYN traffic on supported Standard Load Balancer frontend IP addresses.

Microsoft documents a configurable threshold range from 50,000 to 2,000,000 packets per second. When a custom threshold is configured for a protocol, adaptive automatic tuning is disabled for that protocol on the protected resource, while protocols without custom rules continue using adaptive tuning. Because the feature is still preview and currently scoped to supported Standard Load Balancer frontend IP configurations, buyers should not assume it applies to every protected resource.

What monitoring and incident-response capabilities are included?

Azure DDoS Protection integrates with Azure Monitor for attack metrics and alerting. Microsoft documents mitigation reports, mitigation flow logs, metrics and alerts for both paid tiers. These signals can support incident-response workflows and can be connected to broader security monitoring processes.

DDoS Network Protection customers also receive access to DDoS Rapid Response during active attacks. Microsoft positions that team as an escalation path for attack investigation and post-attack analysis. This support is one of the important differences between Network Protection and the lower-cost IP Protection model.

What should buyers know about cost protection and scaling?

DDoS Network Protection includes a cost-protection benefit for eligible resource costs caused by a documented DDoS attack. Microsoft's pricing page gives examples including scale-out of virtual machines and Azure Kubernetes Service, data processing for Azure Firewall and Application Gateway, network data egress during amplification scenarios, and scale-out of backend PaaS resources.

This does not mean every infrastructure or security cost is automatically reimbursed. Buyers should still design workloads for resilience, configure alerts, understand autoscaling behavior and maintain an incident-response plan. Microsoft also recommends approved DDoS simulation testing rather than waiting for a real attack to expose architectural weaknesses.

What are the current limitations?

Azure DDoS Protection does not support every Azure service or networking design. Microsoft's March 17, 2026 tier comparison lists unsupported scenarios including multitenant PaaS services, public IP resources attached to NAT Gateway, and classic VM deployments. DDoS IP Protection also does not support Basic-tier public IP resources.

VPN gateways and virtual network gateways use a DDoS policy but do not currently receive the same adaptive tuning behavior. Microsoft also notes that public IP prefixes linked to public load balancer frontends are supported with the Network Protection tier. For Virtual Machine Scale Sets, individual-instance DDoS telemetry is available with Flexible orchestration mode.

How does Azure DDoS Protection compare with Azure Firewall and WAF?

Azure DDoS Protection, Azure Firewall and Web Application Firewall solve different security problems. DDoS Protection focuses on large-scale network-layer availability attacks. Azure Firewall provides centralized stateful network filtering and policy. WAF inspects HTTP and HTTPS traffic for application-layer threats.

Organizations with public web applications often need more than one of these controls. A common pattern is DDoS Protection for volumetric and protocol attacks plus WAF on Application Gateway or another supported application-delivery layer for web-specific attacks. The services should be selected as complementary controls rather than treated as interchangeable products.

Who should choose something else?

A small Azure deployment with only one or two low-risk public endpoints may decide that Azure's platform-level infrastructure protection plus good application architecture is sufficient, especially when the business impact of an outage is limited. Teams protecting fewer than 15 eligible public IP resources should compare DDoS IP Protection against Network Protection rather than automatically choosing the larger plan.

Organizations whose main risk is application-layer abuse, credential attacks, malicious bots or HTTP request exploits should prioritize WAF, identity controls, rate limiting and application security because DDoS Protection does not replace them. Workloads outside Azure or designs based on unsupported Azure services also need another DDoS mitigation strategy.