Skip Navigation

Azure DDoS Protection pricing

Protect your applications from Distributed Denial of Service (DDoS) attacks

DDoS Protection enables you to protect your Azure resources from denial of service (DoS) attacks with always-on monitoring and automatic network attack mitigation. There is no upfront commitment and your total cost scales with your cloud deployment.

Explore pricing options

Apply filters to customise pricing options to your needs.

Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, and the currency exchange rate. Prices are calculated based on US dollars and converted using Thomson Reuters benchmark rates refreshed on the first day of each calendar month. Sign in to the Azure pricing calculator to see pricing based on your current programme/offer with Microsoft. Contact an Azure sales specialist for more information on pricing or to request a price quote. See frequently asked questions about Azure pricing.

A single Azure DDoS Protection Plan in a tenant can be used across multiple subscriptions. The Azure DDoS Protection service will have a fixed monthly charge. The fixed monthly charge includes protection for 100 resources. Protection for additional resources will be charged on a monthly per-resource basis.

Price
Monthly price for Azure DDoS Protection (includes protection for 100 resources) $2944/month
Overage charges (more than 100 resources) $29.5 per resource per month

DDoS Protection is enabled at the Virtual Network level. All protected resource types within the Virtual Network will be automatically protected when DDoS Protection is enabled on the Virtual Network. When Application Gateway with WAF is deployed in a DDoS protected VNet, there are no additional charges for WAF - you pay for the Application Gateway at the lower non-WAF rate.

If the resource is protected with DDoS Protection Standard, any scale out costs during a DDoS attack are covered and customer will get the cost credit back for those scaled out resources.

Examples of resources:

  • Data process (ingress/egress) for Azure firewall, AppGW/WAF
  • Scale out of VMs, AKS
  • Data egress for network bandwidth-happens during an amplification attack when DDoS impacted app makes outbound connections.
  • Scale out of backend PaaS resources like SQL, CosmosDB, Storage, App Services etc.

Pricing Examples

Example 1 DDoS Protection Standard Plan in a single subscription and multiple VNETs

Let us assume you have only 1 subscription in your tenant. You create DDoS Plan in that subscription. That subscription will be billed $2944/month. Now the same DDoS Plan can be linked to any number of VNET in that subscription to the same plan.

Total monthly bill for DDoS Standard will be $2944/month = $2944/month.

Example 2 DDoS Protection Standard Plan across the tenant (multiple subscriptions) and multiple VNETs

Let us assume you have 10 subscriptions in your tenant. You create DDoS Plan in subscription # 1. The subscription # 1 will be billed $2944/month. The same plan can now be linked to any VNET across all your 10 subscriptions and across different regions.

Total monthly bill for DDoS Standard will be $2944/month = $2944/month.

Example 3 DDoS Protection Standard Plan across the tenant (multiple subscriptions) and multiple VNETs with more than 100 Public IPs.

Let us assume you have 10 subscriptions in your tenant. You create DDoS Plan in subscription # 1. The subscription # 1 will be billed $2944/month. The same plan can now be linked to any VNET across all your 10 subscriptions and across different regions. Let us assume that there are total 110 public IPs that are protected by DDoS Std. (DDoS Plan). For each public IP above 100, there is a $29.5 per resource per month charge.

Total monthly bill for DDoS Standard will be $2944/month + $29.5 per resource per month (10 public IPs above 100) = $2973/month.

Example 4 DDoS Protection Standard Plan with Web Application Firewall Application Gateway

Let's assume you deploy an Application Gateway with Web Application Firewall (WAF) in a virtual network (VNet) protected by DDoS Protection Standard. In this scenario, you will be charged the base pricing for your Application Gateway, instead of the higher tier of Application Gateway with WAF pricing. This means that there is no extra charge for the WAF usage. This discount applies to both Application Gateway WAF and WAF_v2 SKUs.

For example, if you are not using DDoS Protection Standard and deploy an Application Gateway WAF_v2, you are charged $0.558 per gateway-hour. If you deploy the same resource type (Application Gateway WAF_v2) and you are using DDoS Protection Standard to protect that VNet, you will be charged the standard Application Gateway price of $0.31 per gateway-hour.

Azure pricing and purchasing options

Connect with us directly

Get a walkthrough of Azure pricing. Understand pricing for your cloud solution, learn about cost optimisation and request a custom proposal.

Talk to a sales specialist

See ways to purchase

Purchase Azure services through the Azure website, a Microsoft representative or an Azure partner.

Explore your options

Additional resources

Azure DDoS Protection details

Learn more about Azure DDoS Protection features and capabilities.

Pricing calculator

Estimate your expected monthly costs for using any combination of Azure products.

SLA

Review the Service Level Agreement for this product.

Documentation

Review technical tutorials, videos and more Azure DDoS Protection resources.

  • Resources are counted at the enrolment level. Monthly price for DDoS Protection will be billed against the subscription that is associated with the DDoS Protection Plan.
  • A resource is a Public IP attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Service Fabric or an IaaS based Network Virtual Appliance (NVA). Protection also covers public IP ranges brought to Azure via Custome IP Prefixes (BYOIPs). Additional protected resources may be added in the future.
  • If your DDoS Protection service is active for the entire month, you will be charged the monthly fee regardless of usage. However, if your service was active only for a portion of the month, you would only receive a prorated note for the hours used.

Talk to a sales specialist for a walk-through of Azure pricing. Understand pricing for your cloud solution.

Get free cloud services and a $200 credit to explore Azure for 30 days.

Added to estimate. Press 'v' to view on calculator
Can we help you?