Azure DDoS Protection: IP vs Network Tier, Prices and When to Buy
Every Azure public IP already sits behind Microsoft's infrastructure-level DDoS protection, but that layer has no alerts and a threshold sized for Azure, not for your application. The paid service comes in two tiers: IP Protection at $199 per public IP per month and Network Protection at $2,944 per month for up to 100 public IPs across your tenant, so the break-even sits at 15 IPs. This guide gives the prices, the feature table, which resources are covered, the steps to turn it on, and what to do during an attack.
The short answer: under 15 public IPs, buy IP Protection
Microsoft's FAQ for the service (Microsoft Learn, March 2026) states the rule: with fewer than 15 public IP resources, the IP Protection tier is the cheaper option; with more than 15, Network Protection is. The arithmetic at Microsoft's published US pay-as-you-go rates: 14 public IPs under IP Protection cost 14 × $199 = $2,786 per month, while 15 cost $2,985, more than the $2,944 Network Protection plan that covers 100.
Three exceptions push a smaller environment to Network Protection anyway:
- You run Application Gateway with WAF. In a Network Protection-enabled virtual network, Application Gateway is billed at the non-WAF rate (v1 and v2), which offsets part of the plan fee.
- You want Microsoft engaged during an attack. The DDoS Rapid Response team is available only to Network Protection customers.
- Your public IPs are the Basic SKU. IP Protection covers Standard-SKU public IPs only.
One rule in the other direction: a single virtual machine behind one public IP is supported but not recommended, because mitigation might not start instantly and a machine that cannot scale out will go down. Put a load balancer and two instances, or Application Gateway, in front first and buy protection second. And if you have no public IPs at all, because everything is reached through VPN, ExpressRoute or private endpoints, there is nothing to buy.
What Azure protects at no charge, and where it stops
Azure DDoS infrastructure protection covers every Azure service that uses public IPv4 and IPv6 addresses, including platform services such as Azure DNS, with no configuration and no charge (Microsoft Learn tier comparison, March 2026). It mitigates common network-layer floods at the Azure edge.
Microsoft is direct about the limits: the infrastructure layer has a higher threshold than most applications can absorb, and it provides no telemetry and no alerting. Traffic the platform treats as harmless can still saturate a two-core web server, and you get no metric, no log and no support path when it does.
The paid tiers change three things: a per-IP traffic profile learned from your own traffic, so mitigation starts at your application's threshold rather than Azure's; metrics, alerts, mitigation reports and flow logs; and, on the Network tier, Microsoft's response team and cost protection.
Neither tier inspects HTTP. Azure DDoS Protection works at layers 3 and 4; an HTTP flood needs Azure WAF on Application Gateway or Azure Front Door, with rate-limiting rules and bot protection.
IP Protection vs Network Protection: the feature table
The two tiers share one mitigation engine. The differences are the value-added services and the billing unit (Microsoft Learn, tier comparison, March 2026).
| Feature | IP Protection | Network Protection |
|---|---|---|
| Always-on monitoring, layer 3 and 4 automatic mitigation | Yes | Yes |
| Mitigation policies tuned to your traffic (adaptive tuning) | Yes | Yes |
| Metrics, alerts, mitigation reports, mitigation flow logs | Yes | Yes |
| Azure Firewall Manager integration, Microsoft Sentinel connector and workbook | Yes | Yes |
| Protection across subscriptions in one tenant | Yes | Yes |
| Standard-SKU public IP protection | Yes | Yes |
| Basic-SKU public IP protection | No | Yes |
| DDoS Rapid Response support | Not available | Yes |
| Cost protection (service credits for scale-out and data transfer during a documented attack) | Not available | Yes |
| WAF discount on Application Gateway | Not available | Yes |
| Billing unit | Per protected public IP | Per plan, 100 public IPs included |
On both tiers, each protected public IP gets three auto-tuned mitigation policies (TCP SYN, TCP and UDP) with thresholds set from your traffic profile; mitigation starts when a threshold is exceeded and stops when traffic falls back. A DDoS Protection custom policy (preview as of March 2026) sets fixed packets-per-second thresholds for Standard Load Balancer front-end IPs instead.
What it costs and how Azure bills it
Both tiers are consumption charges on your own Azure subscription, not licenses, and rates vary by region. Microsoft's US pay-as-you-go rates on the Azure DDoS Protection pricing page, checked on 11 October 2026, are $199 per protected public IP per month for IP Protection and $2,944 per month for a Network Protection plan that includes 100 public IP resources; Microsoft's FAQ says protection for resources beyond the 100 is available, priced on the same page.
Billing rules to know before you enable anything:
- A plan bills from the moment it exists, linked or not. Disabling protection on a virtual network does not stop the charge; you must delete the plan, which is allowed only after every virtual network is dissociated.
- One plan per tenant. It can be linked to virtual networks in any subscription under the same Microsoft Entra tenant, so subscriptions with 25, 15 and 8 public IPs pay one plan fee for all 48.
- IP Protection bills per public IP from the moment it is enabled; if the network is later linked to a plan, Microsoft bills the lower plan rate automatically.
- Telemetry is included. Metrics stay in Azure Monitor for 30 days at no extra charge; diagnostic logs in a Log Analytics workspace are an ordinary ingestion cost.
Which resources are covered, and which are not
Protection attaches to public IPs in Resource Manager virtual networks. Microsoft's reference-architecture page (March 2026) lists the supported resources: public IPs on IaaS virtual machines, Azure Load Balancer (Standard and classic), Application Gateway including the WAF SKU, Azure Firewall, Azure Bastion, VPN Gateway, Service Fabric and network virtual appliances; API Management Premium with virtual network integration; custom IP prefixes you bring to Azure; and, on Network Protection only, public IP prefixes on a load balancer front end.
Not supported: Azure Virtual WAN, API Management in other modes, multitenant platform endpoints (App Service, Storage, Event Hubs), public IPs on a NAT Gateway and classic virtual machines. VPN and virtual network gateways get a DDoS policy but no adaptive tuning.
For a web application on App Service, that means Application Gateway or Front Door in front, the app restricted to traffic from the gateway, and the gateway's public IP protected. In a hub-and-spoke design, link the hub virtual network so the firewall's and Bastion's public IPs are covered, then each spoke with its own public IP.
Turning it on: the steps
You need the Network Contributor role or a custom role with the DDoS actions. Microsoft's quickstart (Microsoft Learn, January 2026) is short:
- Create the plan. Search the portal for "DDoS protection plan" and create one in a resource group and region of your choice.
- Link the virtual networks. On an existing network, open DDoS protection under Settings, select Enable and choose the plan. New networks have the same switch on the Security pane. From the plan, Protected resources > Add links several at once.
- Enforce it. A built-in Azure Policy definition finds virtual networks without Network Protection and can remediate them, so a new network never goes unprotected by accident.
- IP Protection instead: enable it on the Standard-SKU public IP resource itself. No plan is needed.
- Send telemetry somewhere. Add a diagnostic setting on each protected public IP with all logs and all metrics going to a Log Analytics workspace.
- Create alerts on the metric Under DDoS attack or not changing to 1 and on Inbound packets dropped DDoS. Metrics appear within about five minutes; attack metrics within five to seven.
- Connect the security tooling. Mitigation alerts flow into Microsoft Defender for Cloud automatically; Microsoft Sentinel has a connector and workbook for the flow logs.
The setup is an afternoon. The slower part is the inventory before step 2: every public IP, what it fronts, who owns it and whether it is still needed.
During an attack: alerts, Rapid Response and the post-mortem
Mitigation needs no action from you. What you need is to know it is happening and whether the application is coping, so watch two things: the DDoS metrics, which say traffic is being scrubbed, and application monitoring (Application Insights or a synthetic probe), which says whether users are still served.
Engage DDoS Rapid Response (Network Protection only) when the resource is severely degraded or unavailable, when you believe mitigation is not working, when the attack has critical business impact, or ahead of a planned event that will multiply traffic. Open a support request: issue type Technical, service DDoS Protection, resource set to the plan linked to the attacked network, severity A, problem type "Under attack". IP Protection customers open a standard support request.
Expect attack analytics every five minutes while the attack runs and a summary when it ends. Afterwards, run a post-mortem on Microsoft's three questions: was there disruption because the design could not scale, which applications suffered most, and how should the response plan change. Then test. Microsoft permits simulations only through its approved partners (MazeBolt, Red Button and RedWolf), only against protected public IPs in your own Azure subscription.
Pay for fewer public IPs
The price is per public IP, so the cheapest DDoS control is architecture. Microsoft's cost-optimization guidance for the service (March 2026) reduces to five moves: inventory every public IP and tag its criticality; replace public endpoints with Private Link, Azure Bastion and peering; consolidate ingress behind one Application Gateway or Front Door; scale behind the protected IP; and review quarterly with a cost alert on the DDoS line.
A worked example at the published US rates: a 40-person firm with three public IPs (a web server, an SFTP host and a VPN gateway) pays 3 × $199 = $597 per month under IP Protection. Moving SFTP behind the firewall and the website behind Application Gateway leaves two public IPs at $398 per month, and the gateway adds a WAF for the layer-7 attacks DDoS Protection does not see.
Frequently asked questions
Is Azure DDoS Protection free?
The infrastructure-level protection is included with every Azure public IP at no charge. The paid tiers add per-application tuning, telemetry and alerts; Microsoft's published US rates are $199 per public IP per month and $2,944 per month for a 100-IP plan.
What is the difference between DDoS IP Protection and Network Protection?
The same engine, monitoring, alerts and logs. Network Protection adds Basic-SKU IP coverage, DDoS Rapid Response, cost protection and the Application Gateway WAF discount, billed per plan rather than per IP. Microsoft's FAQ puts the break-even at 15 public IPs.
Does Azure DDoS Protection cover App Service or Azure Storage?
Not directly. Multitenant platform endpoints such as App Service, Storage and Event Hubs keep the infrastructure-level protection only. Put Application Gateway or Front Door in front and protect the gateway's public IP.
Do I still need a WAF if I have DDoS Protection?
Yes, for web applications. DDoS Protection mitigates layer 3 and 4 attacks; HTTP floods need Azure WAF on Application Gateway or Front Door, and Microsoft recommends DDoS Protection on the WAF's own virtual network too.
Can I protect on-premises servers with Azure DDoS Protection?
Only through an Azure front end: the public endpoint must be a public IP in an Azure virtual network, for example an Application Gateway whose back end is a website in your data center.
How do I stop the charge after a test?
Dissociate every virtual network and delete the plan resource; disabling protection on a network leaves the plan, and the plan is what Azure bills. For IP Protection, disable it on the public IP resource.
Sources
- About Azure DDoS Protection tier comparison — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11
- Azure DDoS Protection frequently asked questions — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11 (15-IP rule, WAF discount, plan billing)
- Compare pricing between Azure DDoS Protection tiers — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11
- Azure DDoS Protection pricing — Microsoft; the US rates of $199 per protected IP and $2,944 per plan were confirmed through search excerpts of the page on 2026-10-11; rates vary by region
- What is Azure DDoS Protection? and Azure DDoS Protection features — Microsoft Learn, ms.date 07/08/2025 and 03/17/2026, checked 2026-10-11
- Azure DDoS Protection reference architectures — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11
- Quickstart: Create and configure Azure DDoS Network Protection using the Azure portal — Microsoft Learn, ms.date 01/26/2026, checked 2026-10-11
- Azure DDoS Rapid Response and Tutorial: Azure DDoS Protection simulation testing — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11
- DDoS Protection cost optimization principles — Microsoft Learn, ms.date 03/17/2026, checked 2026-10-11
Key takeaways
- Azure's infrastructure-level DDoS protection is included with every public IP but has no alerts and a threshold sized for Azure, not for your application.
- IP Protection is $199 per public IP per month and Network Protection $2,944 per month for 100 IPs across the tenant at Microsoft's US pay-as-you-go rates; Microsoft's own break-even is 15 IPs.
- Only Network Protection gives you DDoS Rapid Response, cost protection, Basic-SKU IP coverage and the Application Gateway WAF discount.
- App Service, Storage, Event Hubs, Virtual WAN and NAT Gateway addresses are not protected resources; put Application Gateway or Front Door in front and protect that IP.
- A plan bills from the moment it exists until you delete it; disabling protection on a virtual network does not stop the charge.
- DDoS Protection stops layer 3 and 4 attacks only; web applications still need Azure WAF, and a single VM behind one public IP is not a design Microsoft recommends.
- The cheapest control is fewer public IPs: private endpoints, Bastion, one consolidated ingress and a quarterly inventory.
If you want the public-IP inventory done and the right tier enabled with alerts that reach someone, Securing your Azure Environment and Applications is billed at $175 per hour and quoted in writing before work begins; the Azure Well-Architected Review with Remediation Sprint ($4,950 per project) covers DDoS alongside identity, network and backup, and the Azure Resource Monitoring and Maintenance Service ($5 per server plus a $300 tenant fee) keeps the alerts watched afterwards. The DDoS charges themselves are Microsoft's and appear on your own Azure bill. Book a 30-minute call with your public IP count and we will tell you which tier the math favors.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.