Azure DDoS Protection

DDoS Attack Types

Protection Tiers

DDoS Infrastructure Protection (Free)

Automatically applied to all Azure services. Provides basic protection against common attacks that affect the Azure platform itself. No SLA, no telemetry, no adaptive tuning. Sufficient for most standard workloads that don't specifically target your application.

DDoS IP Protection

Pay-per-protected-IP model — enable on individual public IP resources. Includes adaptive tuning, telemetry, alerts, and post-attack reports. Cheaper than Network Protection for workloads with few public IPs. No DDoS Rapid Response support.

DDoS Network Protection

The most comprehensive tier — enabled at VNet level, protects all public IP resources in the VNet. Includes everything in IP Protection plus DDoS Rapid Response (access to Microsoft DDoS experts during an attack) and SLA credit guarantee.

How Mitigation Works

When an attack is detected against your resources:

1. Azure's network monitors traffic patterns continuously
2. When anomalous traffic is detected (traffic exceeding learned baselines), mitigation begins automatically
3. Attack traffic is scrubbed — malicious packets are dropped while legitimate traffic passes through
4. Azure's global network scale absorbs volumetric floods (terabits per second capacity)
5. After attack subsides, mitigation is removed automatically

Adaptive Tuning

DDoS IP and Network Protection learn the normal traffic patterns for your application over time. When traffic deviates significantly from the learned baseline, mitigation triggers. This reduces false positives compared to static threshold-based approaches — your legitimate traffic spikes (e.g., flash sales) won't accidentally trigger mitigation.

Telemetry and Alerts

With IP or Network Protection enabled, you get:

• Real-time attack metrics in Azure Monitor (packets dropped, attack vectors, attack type)
• Attack start/stop alerts
• Post-attack mitigation reports
• Integration with Azure Sentinel for SIEM alerting

SLA Credit Guarantee

DDoS Network Protection includes a financial protection — if a DDoS attack causes your application to scale out or incur extra compute/bandwidth charges, Microsoft provides service credits to offset those costs. Available only with Network Protection tier.

DDoS Rapid Response

During an active attack, DDoS Network Protection customers can engage Microsoft's DDoS experts for assistance — available 24/7 during an ongoing attack. They can help identify the attack type, recommend mitigations, and provide guidance. Only available with Network Protection tier.

Enabling DDoS Protection

# Create DDoS protection plan
az network ddos-protection create \
  --name myDdosPlan \
  --resource-group myRG \
  --location centralindia

# Link to VNet
az network vnet update \
  --name myVNet \
  --resource-group myRG \
  --ddos-protection-plan myDdosPlan \
  --ddos-protection true