Azure DDoS Protection pricing
Protect your Azure resources from denial of service threats
US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.
Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.
Azure Germany is available to customers and partners who have already purchased this, doing business in the European Union (EU), the European Free Trade Association (EFTA), and in the United Kingdom (UK). It provides data residency in Germany with additional levels of control and data protection. You can also sign up for a free Azure trial.
The DDoS Protection service will have a fixed monthly charge, as well as a charge for data processed. The fixed monthly charge includes protection for 100 resources. Protection for additional resources will be charged on a monthly per-resource basis.
Monthly price for DDoS Protection (includes protection for 100 resources): $2944/month *
Overage charges (more than 100 resources): $30 per resource per month *
|Data Processed per month||Price per GB|
|0 - 100 TB||$0.05|
|100 TB - 500 TB||$0.04|
|500 TB - 1 PB||$0.03|
|Over 1 PB||Contact Us|
* Price is based on 730 hours per month.
DDoS Protection is enabled at the Virtual Network level. All protected resource types within the Virtual Network will be automatically protected when DDoS Protection is enabled on the Virtual Network. The WAF discount applies to Application Gateway WAF instances deployed into protected Virtual Networks.
Example 1 DDoS Protection Standard Plan in a single subscription and multiple VNETs
Let’s assume you have only 1 subscription in your tenant. You create DDoS Plan in that subscription. That subscription will be billed $2944/month. Now the same DDoS Plan can be linked to any number of VNET in that subscription to the same plan. There will data process charges for each VNET that is linked to the DDoS Plan. Let’s assume DDoS data process charge is $50.
Total monthly bill for DDoS Standard will be $2944/month + $50 = $2994/month.
Example 2 DDoS Protection Standard Plan across the tenant (multiple subscriptions) and multiple VNETs
Let’s assume you have 10 subscriptions in your tenant. You create DDoS Plan in subscription # 1. The subscription # 1 will be billed $2944/month. The same plan can now be linked to any VNET across all your 10 subscriptions and across different regions. There will data process charges for each VNET that is linked to the DDoS Plan. Let’s assume DDoS data process charge is $500 for all VNETs that is linked to DDoS Plan.
Total monthly bill for DDoS Standard will be $2944/month + $500 = $3444/month.
Example 3 DDoS Protection Standard Plan across the tenant (multiple subscriptions) and multiple VNETs with more than 100 Public IPs.
Let’s assume you have 10 subscriptions in your tenant. You create DDoS Plan in subscription # 1. The subscription # 1 will be billed $2944/month. The same plan can now be linked to any VNET across all your 10 subscriptions and across different regions. There will data process charges for each VNET that is linked to the DDoS Plan. Let’s assume DDoS data process charge is $500 for all VNETs that is linked to DDoS Plan. Let’s further assume that there are total 110 public IPs that are protected by DDoS Std. (DDoS Plan). For each public IP above 100, there’s a $30 per resource per month charge.
Total monthly bill for DDoS Standard will be $2944/month + $500 + $295 per resource per month (10 public IPs above 100) = $3739 per resource per month.
Support & SLA
- We provide technical support for all Azure services released to general availability, including VPN Gateway, through Azure Support, starting at $29/month. Billing and subscription management support is provided at no cost.
- SLA—To learn more about our SLA, please visit the SLA page
Resources are counted at the enrollment level. Monthly price for DDoS Protection and overage charges will be billed against the subscription that is associated with the DDoS Protection Plan. Data processing charges will be billed against their corresponding subscriptions.
A resource is a Public IP attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Service Fabric or an IaaS based Network Virtual Appliance (NVA). Additional protected resources may be added in the future.
Data processing for the above protected resources is egress bandwidth from any VM on the DDoS protected Virtual Network (VNET). The total amount of egress bandwidth across those VMs is aggregated and use for billing purposes. Egress traffic to the Internet is calculated. Traffic within the VNETs, across VNETs or traffic to ExpressRoute or VPN Gateway is not counted. The data processing charge reflects compute and storage resources required to analyze and store application traffic patterns for historical analysis. Data processing charges allow for a pricing model that scales as your application scales or to have lower overall charges for development or test environments that they wish to protect. Data processing charges apply in conjunction with the VM network egress bandwidth charges. Egress charges are additional.
If your DDoS Protection service is active for the entire month, you will be charged the monthly fee regardless of usage. However, if your service was active only for a portion of the month, you would only receive a prorated bill for the hours used and data transfer overage incurred.
Estimate your monthly costs for Azure services
Review Azure pricing frequently asked questions
Learn more about Azure DDoS Protection
Review technical tutorials, videos, and more resources