Protect your Azure resources from distributed denial-of-service (DDoS) attacks
Azure DDoS Protection enables you to protect your Azure resources from distributed denial of service (DDoS) attacks with always-on monitoring and automatic network attack mitigation. There is no upfront commitment, and your total cost scales with your cloud deployment.
Azure DDoS Protection offers two tiers – IP Protection and Network Protection – to meet your security and cost needs.
Explore pricing options
Apply filters to customise pricing options to your needs.
Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, and the currency exchange rate. Prices are calculated based on US dollars and converted using London closing spot rates that are captured in the two business days prior to the last business day of the previous month end. If the two business days prior to the end of the month autumn on a bank holiday in major markets, the rate setting day is generally the day immediately preceding the two business days. This rate applies to all transactions during the forthcoming month. Sign in to the Azure pricing calculator to see pricing based on your current programme/offer with Microsoft. Contact an Azure sales specialist for more information on pricing or to request a price quote. See frequently asked questions about Azure pricing.
US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.
Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.
US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.
Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.
Network Protection will have a fixed monthly charge, which includes protection for 100 public IP resources. Protection for additional public IP resources will be charged on a monthly per-resource basis. A single Azure DDoS Protection plan in a tenant can be used across multiple subscriptions.
| Price | |
|---|---|
| Monthly charge (includes protection for 100 public IP resources) | $-/month |
| Overage charges (more than 100 public IP resources) | $- per resource per month |
Network Protection is enabled at the virtual network (VNet) level. All protected resource types within the virtual network will be automatically protected when Network Protection is enabled on the virtual network. When Azure Application Gateway with WAF is deployed in a protected virtual network, there are no additional charges for WAF - you pay for the Application Gateway at the lower non-WAF rate.
If the resource is protected with Network Protection, any scale out costs during a DDoS attack are covered and customer will get the cost credit back for those scaled out resources.
Examples of resources:
- Data process (ingress/egress) for Azure Firewall, Application Gateway with WAF
- Scale out of Virtual Machines and Azure Kuberentes Service
- Data egress for network bandwidth-happens during an amplification attack when DDoS impacted app makes outbound connections.
- Scale out of backend PaaS resources like SQL, CosmosDB, Storage, App Services etc.
Pricing Examples
Example 1 Network Protection plan in a single subscription and multiple VNets
Let's assume you have only 1 subscription in your tenant. You create a Network Protection plan in that subscription. That subscription will be billed $-/month. Now the same Network Protection plan can be linked to any number of VNets in that subscription to the same plan.
Total monthly bill for the Network Protection plan will be $-/month = $-/month.
Example 2 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets
Let's assume you have 10 subscriptions in your tenant. You create a Network Protection plan in subscription # 1. The subscription # 1 will be billed $-/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions.
Total monthly bill for a Network Protection plan will be $-/month = $-/month.
Example 3 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets with more than 100 Public IPs
Let's assume you have 10 subscriptions in your tenant. You create a Networking Protection plan in subscription # 1. The subscription # 1 will be billed $-/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions. Let's assume that there are total 110 public IPs that are protected by Network Protection. For each public IP above 100, there's a $- per resource per month charge.
Total monthly bill for Network Protection plan will be $-/month + $- ($- per additional resource per month (10 public IPs above 100)) = $-/month.
Example 4 Network Protection plan with Azure Web Application Firewall (WAF) with Azure Application Gateway
Let's assume you deploy an Azure Application Gateway with Azure Web Application Firewall (WAF) in a VNet protected by Network Protection. In this scenario, you will be charged the base pricing for your Application Gateway, instead of the higher tier of Application Gateway with WAF pricing. This means that there is no extra charge for the WAF usage. This discount applies to both Application Gateway WAF and WAF_v2 SKUs.
For example, if you are not using Network Protection and deploy an Application Gateway WAF_v2, you are charged $0.558 per gateway-hour. If you deploy the same resource type (Application Gateway WAF_v2) and you are using Network Protection to protect that VNet, you will be charged the standard Application Gateway price of $0.31 per gateway-hour.
IP Protection is used to protect an individual public IP resource and will have a fixed monthly charge per public IP resource protected.
| Price1 | |
|---|---|
| Monthly charge per public IP resource protected | $199/month |
Azure pricing and purchasing options
Connect with us directly
Get a walkthrough of Azure pricing. Understand pricing for your cloud solution, learn about cost optimisation and request a customised proposal.
Talk to a sales specialistSee ways to purchase
Purchase Azure services through the Azure website, a Microsoft representative or an Azure partner.
Explore your optionsAdditional resources
Azure DDoS Protection
Learn more about Azure DDoS Protection features and capabilities.
Pricing calculator
Estimate your expected monthly costs for using any combination of Azure products.
SLA
Review the Service Level Agreement for Azure DDoS Protection.
Documentation
Review technical tutorials, videos, and more Azure DDoS Protection resources.
Frequently asked questions
-
If you need to protect less than 15 public IP resources, the IP Protection tier is the more cost-effective option. If you have more than 15 public IP resources to protect, then the Network Protection tier is more cost-effective. Network Protection also offers additional features, including DDoS Protection Rapid Response (DRR), cost protection guarantees, and Web Application Firewall (WAF) discounts.
-
Resources are counted at the enrolment level. Monthly price for Azure DDoS Protection will be billed against the subscription that is associated with the protection plan.
-
A resource is a Public IP attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Service Fabric or an IaaS based Network Virtual Appliance (NVA). Protection also covers public IP ranges brought to Azure via customised IP prefixes (BYOIPs). Additional protected resources may be added in the future.
-
If your Azure DDoS Protection plan is active for the entire month, you will be charged the monthly fee regardless of usage. However, if your service was active only for a portion of the month, you would only receive a prorated note for the hours used.
Talk to a sales specialist for a walk-through of Azure pricing. Understand pricing for your cloud solution.
Get free cloud services and a $200 credit to explore Azure for 30 days.