Azure DDoS Protection Complete Guide: Network/IP Protection, Always On Detection, WAF Combinations

Azure DDoS Protection is a service that protects Azure resources from Distributed Denial of Service (DDoS) attacks. It comes in three tiers: 1) DDoS Network Protection (formerly DDoS Protection Standard): per-VNet protection, USD 2,944/month + data transfer, protects up to 100 Public IPs, covers Volumetric / Protocol / Application Layer attacks, with Adaptive Tuning (ML-based), Rapid Response Team support, and Cost Protection (refunds scale-out charges incurred during attacks). 2) DDoS IP Protection (GA in 2022): per-Public-IP protection, USD 199/month per IP, designed for smaller workloads. 3) DDoS Infrastructure Protection: baseline protection applied free of charge to every Azure resource (Volumetric attacks only, not tunable). For production internet-facing systems, DDoS Network Protection is the standard choice, and Cost Protection dramatically reduces the risk of runaway cloud spend.

DDoS attacks fall into three categories based on the OSI layer. 1) Volumetric Attacks (L3/L4): UDP Flood, DNS Amplification, NTP Reflection and other attacks that saturate network bandwidth, with peaks now exceeding 1 Tbps. Azure DDoS Protection detects and mitigates them automatically with Always On Detection. 2) Protocol Attacks (L4): SYN Flood, ACK Flood, Fragment Attack and similar techniques that exhaust the network stack. 3) Application Layer Attacks (L7): HTTP Flood, Slowloris, DNS Query Flood and others that exhaust the application's processing resources (WAF integration via Application Gateway / Front Door). Azure DDoS Network Protection fully covers categories 1 and 2, while 3 is handled in production architectures by combining it with Azure WAF (Application Gateway / Front Door Premium).

Azure DDoS Protection detects and mitigates attacks automatically through Always On Detection (24/7 traffic monitoring) and Adaptive Tuning (ML-based learning of normal traffic patterns). The flow is: 1) continuously learn each Public IP's traffic pattern (typical request rate, bandwidth, geographic distribution), 2) detect anomalies with AI (traffic spikes, sudden surges from new IPs), 3) Microsoft's Global DDoS Mitigation Network drops attack traffic at the edge, 4) only legitimate traffic reaches your Azure VNet, 5) a Mitigation Report is generated (attack details, duration, traffic volume), 6) the Microsoft DDoS Rapid Response Team (DRR) provides custom assistance during large-scale attacks. Mitigation kicks in within minutes, and Cost Protection guarantees a refund of the auto-scale charges incurred during the attack. It is the last line of defense for production web services.

DDoS Network Protection: protects at the VNet level, covering every Public IP in the VNet (up to 100) for a flat USD 2,944/month + data transfer. The per-IP cost drops sharply in larger environments (web app fleets, multi-microservice deployments). DDoS IP Protection: protects per Public IP at USD 199/month, designed for smaller startups and environments with only a handful of Public IPs. Rule of thumb: under 15 Public IPs in one VNet → DDoS IP Protection; 15 or more → DDoS Network Protection (199 USD × 15 IP = USD 2,985 > USD 2,944, so Network Protection wins). Extra benefits of Network Protection: Microsoft DDoS Rapid Response Team support (24/7 specialist engineers) and Cost Protection (refunds for auto-scale charges during attacks). For enterprises and production internet-facing systems, DDoS Network Protection is the default choice.

DDoS Protection handles L3/L4 attacks; L7 (Application Layer) attacks require a WAF (Web Application Firewall). Standard architecture: 1) Front Door Premium (Anycast + WAF Premium at the edge, absorbing attacks across 300+ Microsoft Edge locations), 2) Application Gateway WAF v2 (in-region L7 control as the Front Door backend), 3) DDoS Network Protection (L3/L4 protection across the VNet), 4) Azure Firewall (FQDN filtering and outbound governance). Front Door Premium effectively soaks up large-scale DDoS at the edge, so Volumetric Attacks are dropped before they ever reach the Azure VNet. The modern standard pattern for production internet-facing systems is a three-layer stack of Front Door Premium + Application Gateway WAF v2 + DDoS Network Protection, covering every attack from L3 through L7.

DDoS Protection exposes detailed metrics through Azure Monitor. Key metrics: 1) Under DDoS Attack (a flag indicating an active attack), 2) Packets In DDoS (packets/sec mitigated), 3) Bytes In DDoS (bandwidth mitigated), 4) TCP/UDP/Other Packets (drops by protocol), 5) Inbound TCP/UDP/Other Bytes Dropped. Post-attack DDoS Mitigation Reports include: 1) Attack Vector (protocol and attack technique), 2) Top Source Country, 3) Top Source ASN (source ISP), 4) Top Destination IP (target), 5) Total Packets/Bytes Dropped. Forwarding the data to Microsoft Sentinel enables KQL analytics and Logic App Playbook automation (e.g., during an attack, post to Slack, escalate to the CISO, email stakeholders). Monthly DDoS Reports reviews are the standard pattern for production operations.

DDoS Protection cost components: 1) DDoS Network Protection flat USD 2,944/month, 2) DDoS IP Protection USD 199 per Public IP, 3) Mitigation data transfer (attack traffic volume, normally zero), 4) Microsoft DRR support (included with DDoS Network Protection). Cost reduction tactics: 1) pick DDoS IP Protection when you have fewer than 15 Public IPs, 2) delete unused Public IPs (199 USD/month each), 3) lean on Front Door Premium to absorb attacks at the edge (no cost since the traffic never reaches the Azure VNet), 4) use Cost Protection to recover auto-scale charges during attacks (DDoS Network Protection only), 5) consolidate Public IPs into a single VNet (one DDoS Network Protection covers everything instead of spreading across multiple VNets). This is critical for cost optimization of production internet-facing systems, and because Microsoft DRR support brings significant value, DDoS Network Protection is also the economically rational choice at enterprise scale.

AZ-700 (Network Engineer Associate) is the main exam where DDoS Protection is tested in depth as a core topic. AZ-305 (Solutions Architect Expert) covers DDoS mitigation design from an architect's perspective; SC-100 (Cybersecurity Architect Expert) covers network defense within a Zero Trust strategy; SC-500 (the rebranded AZ-500, GA in September 2026) covers Azure security implementation; SC-200 (Security Operations Analyst) covers DDoS event operations from a SOC perspective. Understanding DDoS Protection is an essential skill for Azure network engineers and security architects, and it is a core incident-prevention capability for production internet-facing systems.