Azure DDoS Protection pricing

Protect your Azure resources from denial of service threats

Azure DDoS Protection enables you to protect your Azure resources from denial of service (DoS) attacks with always-on monitoring and automatic network attack mitigation. There is no up-front commitment, and your total cost scales with your cloud deployment.

Pricing details

The Azure DDoS Protection service will have a fixed monthly charge, as well as a charge for data processed. The fixed monthly charge includes protection for 100 resources. Protection for additional resources will be charged on a monthly per-resource basis.

Monthly price for Azure DDoS Protection (includes protection for 100 resources): $2944/month *

Overage charges (more than 100 resources): $30 per resource per month *, 1

Data processed:

Data processed per month Price per GB
0-100 TB $0.05
100 TB-500 TB $0.04
500 TB - 1 PB $0.03
Over 1 PB Contact Us

* Price is based on 730 hours per month.

Azure DDoS Protection is enabled at the Virtual Network level. All protected resource types within the Virtual Network will be automatically protected when Azure DDoS Protection is enabled on the Virtual Network. The WAF discount applies to Application Gateway WAF instances deployed into protected Virtual Networks.

1 SLB IPs will not be counted towards resource overage until 1 September 2018.

Support and SLA

  • We provide technical support for all Azure services released to general availability, including VPN Gateway, through Azure Support, starting at $29/month. Billing and subscription management support is provided at no cost.
  • SLA – To learn more about our SLA, please visit the SLA page.


  • Resources are counted at the enrolment level. Monthly price for Azure DDoS Protection and overage charges will be billed against the subscription that is associated with the Azure DDoS Protection Plan. Data processing charges will be billed against their corresponding subscriptions.
  • A resource is a public IP attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Service Fabric or an IaaS based Network Virtual Appliance (NVA). Additional protected resources may be added in the future.
  • Data processing for the above protected resources is egress bandwidth from any VM on the Azure DDoS protected Virtual Network (VNET). The total amount of egress bandwidth across those VMs is aggregated and used for billing purposes. Egress traffic to the Internet is calculated. Traffic within the VNETs, across VNETs, or traffic to ExpressRoute or VPN Gateway is not counted. The data processing charge reflects compute and storage resources required to analyse and store application traffic patterns for historical analysis. Data processing charges allow for a pricing model that scales as your application scales, or to have lower overall charges for development or test environments that they wish to protect. Data processing charges apply in conjunction with the VM network egress bandwidth charges. Egress charges are additional.
  • If your Azure DDoS Protection service is active for the entire month, you will be charged the monthly fee regardless of usage. However, if your service was only active for a portion of the month, you will only receive a prorated bill for the hours used and data transfer overage incurred.


Estimate your monthly costs for Azure services

Review Azure pricing frequently asked questions

Learn more about Azure DDoS Protection

Review technical tutorials, videos and more resources

Added to estimate. Press 'v' to view on calculator

Get started with DDoS Protection