Azure Learning

ddos-protection

Properties2
tagsnetworking, security, ddos, ddos-protection
aliasesDDoS Protection, DDoS, DDoS Protection plan

2 min read

Azure DDoS Protection

What it is

Azure DDoS Protection defends public IP assignments against Distributed Denial-of-Service (DDoS) attacks. It has two tiers: DDoS Network Protection (Basic, free, always-on) that mitigates common network-layer attacks, and DDoS Network Protection (Standard) that adds enhanced, tuned monitoring and mitigation for the protected VNet’s public IPs.

Why it exists

Public endpoints are targets for volumetric/protocol/application DDoS floods. You can’t build a defense in every workload, so Azure auto-detects and scrubs attacks at the edge; Standard adds cost-aware, written-into-policy protection with per-IP tuning and telemetry.

Key ideas

  • DDoS Protection (Basic) — always on for all Azure public IPs at no extra cost; only default network-layer mitigation (no tuning/telemetry).
  • DDoS Protection (Standard) — attach the DDoS protection plan to a VNet; its public IPs get: 24/7 monitoring, real-time attack metrics (alerts), baseline-based adaptive tuning, mitigation reports, and per-IP protection.
  • Policy-based — rate-limiting/blackholing rules written to stop attacks while keeping legitimate traffic.
  • Applied at the VNet level (Standard) — all public IPs in that VNet are protected; one plan per subscription region/zone.
  • Works alongside Azure Firewall and NSGs.

How it fits

ddos-protection - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: ddos-protection/ddos-protection-overview

[Attacker traffic] ──► [Azure DDoS edge scrubbing] ──► [Public IP]
                              │                          │
                        (Basic: network-layer)       [protected VNet]
                        (Standard: tuned + telemetry)

Exam notes

  • Basic = free, always-on, network-layer only. Standard = plan + VNet-scoped, adds tuning/telemetry/alerts.
  • Attach Standard to the VNet, not individual IPs; one plan per subscription.
  • DDoS is about defending public endpoints; not an alternative to nsg/Firewall for filtering.

Home · azure-firewall · vnet · nsg

📘 Source: Microsoft Learn — Ddos Protection

Graph View

Backlinks