Azure DDoS Protection

About Azure DDoS Protection

Azure DDoS Protection is Microsoft's managed network-layer defense for Azure workloads exposed through eligible public IP resources. It is designed to detect and automatically mitigate volumetric and protocol attacks at network layers 3 and 4, while application-layer attacks still require controls such as a web application firewall. The service is most relevant to organizations running internet-facing Azure workloads that need stronger protection than the platform's default infrastructure-level DDoS defenses.

What does Azure DDoS Protection protect?

Azure DDoS Protection monitors traffic patterns for eligible Azure public endpoints and automatically applies mitigation when an attack exceeds the learned thresholds for a protected resource. Microsoft currently documents always-on traffic monitoring, adaptive tuning, attack analytics, metrics, alerts and automatic mitigation for supported layer 3 and layer 4 attack vectors.

The service is not a replacement for application-layer security. Microsoft explicitly recommends combining DDoS Protection with a web application firewall for web workloads because WAF products address layer 7 threats while DDoS Protection focuses on network-layer volumetric and protocol attacks.

What is the difference between DDoS Network Protection and IP Protection?

Microsoft currently offers two paid protection models. DDoS Network Protection is enabled at the virtual network level through a DDoS protection plan. Eligible public IP resources in protected virtual networks receive the enhanced protection features, and one plan can cover virtual networks across multiple subscriptions under the same Microsoft Entra tenant.

DDoS IP Protection is enabled directly on an eligible public IP resource and uses a pay-per-protected-IP model. It includes the same core mitigation engineering but does not include every value-added service available with Network Protection. Microsoft specifically notes differences around DDoS Rapid Response, cost protection and Web Application Firewall discounts.

How does Azure DDoS Protection pricing work?

Pricing was checked on August 27, 2026. Microsoft does not use one universal flat price for both tiers. DDoS Network Protection uses a fixed monthly plan charge that currently includes protection for up to 100 public IP resources, with additional protected resources billed separately. DDoS IP Protection is priced per protected public IP resource.

Microsoft's current pricing guidance says IP Protection is generally the more economical option when protecting fewer than 15 public IP resources, while Network Protection becomes more economical above that level and also includes additional service benefits. Actual currency values vary by agreement and billing context, so the BrandLigo page does not hard-code a universal dollar amount.

What monitoring and incident-response capabilities are included?

Azure DDoS Protection integrates with Azure Monitor for attack metrics and alerting. Microsoft documents attack analytics in five-minute increments during an event and a full summary after the attack ends. Mitigation flow logs can also be streamed to Microsoft Sentinel or another supported SIEM workflow for near real-time analysis.

DDoS Network Protection customers also receive access to Azure DDoS Rapid Response during active attacks. Microsoft positions that team as an escalation path for attack investigation and post-attack analysis. This support is one of the important differences between Network Protection and the lower-cost IP Protection model.

What should buyers know about cost protection and scaling?

DDoS Network Protection includes a cost-protection benefit for eligible resource costs caused by a documented DDoS attack. Microsoft describes this as protection for qualifying data-transfer and application scale-out costs that occur during an attack, subject to the service terms and claim process.

This does not mean every security or infrastructure cost is automatically reimbursed. Buyers should still design workloads for resilience, configure alerts, understand autoscaling behavior and maintain an incident-response plan. Microsoft also recommends testing DDoS response through approved simulation partners rather than waiting for a real attack to reveal architectural weaknesses.

What are the current limitations?

Azure DDoS Protection does not support every Azure service or networking design. Microsoft's March 17, 2026 tier comparison lists limitations including unsupported multitenant PaaS scenarios, public IP resources attached to NAT Gateway, and classic VM deployments. DDoS IP Protection also does not support Basic-tier public IP resources.

A single VM directly exposed through a public IP can be protected, but Microsoft does not recommend that architecture. Buyers should also understand that VPN gateways and virtual network gateways use platform DDoS policy behavior and do not receive the same adaptive tuning model as regular protected public IP resources.

How does Azure DDoS Protection compare with Azure Firewall and WAF?

Azure DDoS Protection, Azure Firewall and Web Application Firewall solve different security problems. DDoS Protection focuses on large-scale network-layer availability attacks. Azure Firewall provides centralized stateful network filtering and policy. WAF inspects HTTP and HTTPS traffic for application-layer threats.

Organizations with public web applications often need more than one of these controls. A common pattern is DDoS Protection for volumetric and protocol attacks plus WAF on Application Gateway or another supported application-delivery layer for web-specific attacks. The services should be selected as complementary controls rather than treated as interchangeable products.

Who should choose something else?

A small Azure deployment with only one or two low-risk public endpoints may decide that the platform's default infrastructure protection plus good application architecture is sufficient, especially when the business impact of an outage is limited. Teams protecting fewer than 15 eligible public IP resources should compare DDoS IP Protection against Network Protection rather than automatically choosing the larger plan.

Organizations whose main risk is application-layer abuse, credential attacks, malicious bots or HTTP request exploits should prioritize WAF, identity, rate limiting and application security controls because DDoS Protection does not replace them. Workloads outside Azure or designs based on unsupported Azure services also need another DDoS mitigation strategy.