Azure DDoS Protection
What it is
Azure DDoS Protection helps defend internet-reachable Azure workloads from a distributed denial-of-service (DDoS) attack: a flood of traffic intended to exhaust the service so legitimate customers cannot use it. Its enhanced protection operates at network layers 3 and 4; it is not a web-request filter.
Why it exists
Any public endpoint can be a target. Azure provides default infrastructure-level protection against common network-layer attacks, and Azure DDoS Protection adds enhanced, workload-aware mitigation and operational signals for supported public workloads. For an HTTP(S) attack at layer 7, add a web application firewall and resilient application design.
Key ideas
- Default infrastructure protection applies to Azure services and defends against common network-layer attacks. It is not the same thing as enabling an enhanced DDoS Protection offering for a workload.
- DDoS Network Protection is enabled for a VNet and protects the eligible public resources in that VNet. A single plan can be used across multiple subscriptions in a tenant.
- DDoS IP Protection is enabled per public IP resource and uses a pay-per-protected-IP model. It shares core mitigation engineering with Network Protection but differs in some value-added services.
- Adaptive mitigation and evidence — enhanced protection learns normal traffic patterns, applies mitigation when a threshold is exceeded, and exposes attack metrics, alerts, and reports.
- Layering is intentional. DDoS Protection limits network-layer floods; WAF handles web-request patterns; Azure Firewall and NSGs control allowed traffic paths. None removes the need for capacity, redundancy, application security, and incident response.
Northwind example
Northwind exposes its customer storefront through a public entry point. Maya enables the appropriate DDoS Protection model for its VNet-hosted public workload, configures Azure Monitor alerts, and rehearses the incident response path. A traffic flood is mitigated at the network layer, while the storefront’s WAF separately blocks suspicious HTTP requests such as an attempted SQL-injection pattern. Neither control proves the app can handle every surge, so Northwind also uses scaling and resilient application design.
How it fits
Diagrams courtesy of Microsoft Learn / Azure docs: ddos-protection/ddos-protection-overview
[Attacker traffic] ──► [Azure DDoS edge scrubbing] ──► [Public IP]
│ │
(network-layer mitigation) [protected workload]Exam notes
- DDoS Protection addresses network-layer availability attacks, not application-layer attack logic.
- Network Protection is VNet-scoped; IP Protection is enabled on a public IP resource.
- Pair it with WAF, firewall/NSG rules, application resilience, and an incident plan.
Related
Home · azure-firewall · vnet · nsg