{"rid":"egress/azure-ddos-protection","card":{"rid":"egress/azure-ddos-protection","eid":"microsoft","topic":"egress","slug":"azure-ddos-protection","provider":"Azure DDoS Protection","url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","domain":"microsoft.com","category":"L3/L4 DDoS mitigation for Azure virtual networks","tier":"payg","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"documented","binding":"write-gated","identity_kind":"card","identity_basis":"stated","needs_card":1,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"rest,cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":2,"usd_month":null,"usd_per_tb_month":null,"summary":"No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it.","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"azure-ddos-protection","provider":"Azure DDoS Protection","url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","category":"L3/L4 DDoS mitigation for Azure virtual networks","tier":"payg","free_tier":{"stated":"No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it.","unit":"none","metered_on":"none","source_url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","notes":""},"egress":{"terms":"No volume allowance applies: the product is a mitigation policy on the client's own Azure public IP, not a proxy with a traffic allowance.; ingress: none","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview"},"interface":["rest","cli"],"interface_detail":"a DDoS protection plan attached to a virtual network, or per-public-IP protection","tooling":"Azure portal, CLI or ARM/Bicep","chaining":"chains with an Azure VM, which already has the public IP being protected","limits":[{"kind":"write-gated","value":"protection is enabled on an Azure virtual network and covers the public IPs of resources in it","source":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview"}],"limits_note":"","binding":"write-gated","binding_note":"It cannot be the ingress for a service outside Azure at any volume, so 1 TiB/month never becomes the constraint.","identity_cost":{"kind":"card","detail":"An Azure subscription with a virtual network and a public IP inside it.","country":"None"},"reliability_note":"none recorded","confidence":"documented","confidence_note":"The virtual-network scoping and the TCP and UDP mitigation policies are quoted from the page read today. What it does not do is stated by what it protects, not by an explicit denial.","evidence":[{"url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","date":"2026-10-23","proved":"It's automatically tuned to help protect your specific Azure resources in a virtual network."},{"url":"https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview","date":"2026-10-23","proved":"Azure DDoS Protection applies three auto-tuned mitigation policies (TCP SYN, TCP, and UDP) for each public IP of the protected resource, in the virtual network that has DDoS enabled."}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"unpublished","notes":"Listed by the brief as an L4 candidate. It is mitigation on an address the client already owns in Azure, which is the opposite of the Spectrum shape: no vendor address, no origin mapping, no port forwarding.","extras":{"wg_path":"none","wg_detail":"It filters traffic addressed to an Azure public IP; it does not issue an address that forwards to an origin the client names.","ingress":"none","volume_tib_month":null,"volume_stated":"No volume allowance applies: the product is a mitigation policy on the client's own Azure public IP, not a proxy with a traffic allowance.","bytes_transit":"no","transit_note":"traffic goes for a user's own Azure public IP; nothing is forwarded on the client's behalf"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:write-gated","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}