Azure DDoS Protection
- Free allowance
- No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it.
- Verdict
- fails: egressdata cannot be read back out at a usable rate or price
- Cost
- no price statedsee Price below
- Identity
- cardcard required, no phone
- Binding limit
- write-gatedprotection is enabled on an Azure virtual network and covers the public IPs of resources in it
- Evidence
- documented2 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it. unit none; metered on none |
|---|---|
| Price | unpublished |
| Limits |
|
| Binding | write-gated It cannot be the ingress for a service outside Azure at any volume, so 1 TiB/month never becomes the constraint. |
| Identity | card An Azure subscription with a virtual network and a public IP inside it. |
| Egress | No volume allowance applies: the product is a mitigation policy on a user's own Azure public IP, not a proxy with a traffic allowance.; ingress: none free allowance: none published |
| Interface | rest, cli a DDoS protection plan attached to a virtual network, or per-public-IP protection |
| Tooling | Azure portal, CLI or ARM/Bicep |
| Composes with | chains with an Azure VM, which already has the public IP being protected |
| Reliability | none recorded |
| Evidence note | documented The virtual-network scoping and the TCP and UDP mitigation policies are quoted from the page read. What it does not do is stated by what it protects, not by an explicit denial. |
Evidence 2
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | learn.microsoft.com/en-us/azure/ddos-protection/ddos-protect | It's automatically tuned to help protect your specific Azure resources in a virtual network. |
| 2026-10-23 | learn.microsoft.com/en-us/azure/ddos-protection/ddos-protect | Azure DDoS Protection applies three auto-tuned mitigation policies (TCP SYN, TCP, and UDP) for each public IP of the protected resource, in the virtual network that has DDoS enabled. |
More fields 7
{
"wg_path": "none",
"wg_detail": "It filters traffic addressed to an Azure public IP; it does not issue an address that forwards to an origin a user names.",
"ingress": "none",
"volume_tib_month": null,
"volume_stated": "No volume allowance applies: the product is a mitigation policy on a user's own Azure public IP, not a proxy with a traffic allowance.",
"bytes_transit": "no",
"transit_note": "traffic goes to a user's own Azure public IP; nothing is forwarded on a user's behalf"
}Unknown values 2
$.per_object_cap.statedthe field does not apply to this kind of offer$.retention.statedthe field does not apply to this kind of offer