Do you need paid Azure DDoS Protection? What you already get for free, and what you don't

Every Azure customer already has always-on DDoS protection at the platform level, at no cost — so the real question is not whether you are protected, but whether the paid tier buys you anything your workload needs.

New to cloud? CAMPUX is a free, build-first course. Start here →

Start with the short answer, so you can stop worrying about the wrong thing. Azure already defends every public IP you own against network-layer DDoS attacks, for free, with no switch to flip. Microsoft calls it infrastructure DDoS protection, and the docs are blunt: "At no additional cost, Azure DDoS infrastructure protection protects every Azure service that uses public IPv4 and IPv6 addresses." It requires no configuration and no application change. If you run a handful of internal apps and a small public site, you are almost certainly covered well enough by the tier you are already paying nothing for. The paid tiers exist for a narrower, more expensive problem, and most workloads never meet it.

What the free platform tier does

Azure's infrastructure protection works at the network layers — Layer 3 and Layer 4, the raw packet floods (SYN floods, UDP floods, volumetric traffic) that try to saturate a link before your app ever sees a request. Microsoft's global scrubbing capacity absorbs those at the platform edge, shared across all Azure tenants. You get this whether you asked for it or not. It is genuinely useful: the biggest, dumbest volumetric attacks get soaked up before they reach you.

But understand its limits, because they are the whole reason the paid tiers exist. The free tier is tuned to protect Azure, not to protect your app. It knows nothing about your traffic patterns, so its thresholds are generic. It gives you no telemetry — no attack metrics, no mitigation reports, no alert when you are being hit. And it does nothing at Layer 7, the application layer where a flood of well-formed HTTP requests can exhaust your app while every packet looks perfectly legitimate.

The free tier protects the platform and, in doing so, protects you. The paid tier protects your application specifically — and, just as importantly, tells you when it did.

What the paid tiers add

When you pay, you move from generic to specific. Microsoft's DDoS Protection turns on adaptive real-time tuning: it profiles your application's normal traffic over time and builds mitigation policies shaped to that baseline, so an attack that a generic threshold would shrug at gets caught because it does not match your normal. On top of the tuning you get the things an on-call engineer actually needs during an incident:

• Attack analytics and telemetry. Detailed reports in five-minute increments during an attack, a full summary after it ends, and metrics through Azure Monitor.
• Mitigation reports and flow logs. You can stream mitigation flow logs into Microsoft Sentinel or your SIEM for near real-time monitoring while the attack is live.
• Alerting. Alerts at the start and stop of an attack, wired into Azure Monitor, Splunk, email, or the portal — so you find out from a page, not from a customer.
• Cost protection. Service credit for the data-transfer and scale-out costs you incur because a documented attack forced your resources to scale.
• Rapid response. Access to Microsoft's DDoS Rapid Response team during an active attack, for investigation and post-attack analysis.

Notice the pattern. The free tier stops the flood silently. The paid tier stops a flood tuned to your app, proves it happened, refunds the scale-out bill, and puts a specialist on the phone. For a public, revenue-critical app, those are not luxuries — they are the difference between a footnote and an outage post-mortem.

IP Protection vs Network Protection, briefly

The paid offering comes in two shapes. DDoS IP Protection is billed per protected public IP — you enable it on individual public IP resources, which suits a small deployment with one or two internet-facing endpoints. DDoS Network Protection is a plan priced per 100 protected IPs and applied across a virtual network (and across subscriptions in the tenant), which is the shape you want once you have an estate to defend. They share the same core mitigation engine and the same tuning and telemetry. The differences are at the top end: only Network Protection includes rapid response support, cost protection, the WAF discount, and protection for Basic-tier public IPs. IP Protection deliberately leaves those out to keep the per-IP price down.

The honest decision

Most small workloads should ride the free tier and spend the money elsewhere. If your public surface is a marketing site, some APIs behind a load balancer, and a few internal apps with no public IP at all, the platform protection you already have plus an NSG and a WAF is a sensible posture. Paying per IP to profile traffic on an endpoint nobody is targeting is spending real dollars on telemetry you will never open. The paid tier earns its keep when downtime costs money by the minute — a public storefront, a payments API, a login service whose outage is a headline. There, the tuned mitigation, the live telemetry, the cost-protection credit, and the rapid-response line are worth the monthly bill precisely because you can name what an hour of downtime costs. Buy protection against the risk you actually carry, not the one that sounds scariest.

The takeaway

You are already protected against network-layer DDoS on every Azure public IP, for free, forever, with nothing to configure. The paid tiers, IP Protection per resource and Network Protection per plan, buy you mitigation tuned to your own traffic, the telemetry and reports to prove an attack, cost-protection credits, and a rapid-response team. So ride the free platform protection until an outage would cost real money, then add Network Protection with a WAF beside it. That is a decision you make by reading the invoice, not the marketing.

Questions people also ask

Is Azure DDoS Protection free?

Infrastructure DDoS protection is free for every Azure customer. It defends every public IP against network-layer floods with no configuration and no charge. The paid tiers, DDoS IP Protection and DDoS Network Protection, are billed per resource or per plan and add tuning, telemetry, and support that the free platform tier does not include.

Do I need Azure DDoS Protection?

Most small workloads do not need the paid tier. You already get free network-layer protection on every public IP, so a marketing site or internal apps behind a load balancer are covered. Pay for a tier when downtime costs money by the minute, such as a public storefront, a payments API, or a login service.

What is the difference between DDoS IP Protection and Network Protection?

Both share the same mitigation engine, tuning, and telemetry. IP Protection is billed per protected public IP and suits one or two endpoints. Network Protection is a plan priced per 100 IPs across a virtual network, and it alone adds rapid response support, cost protection, the WAF discount, and protection for Basic-tier public IPs.

Does Azure DDoS Protection cover Layer 7 attacks?

No. Both DDoS tiers work only at Layer 3 and Layer 4, the network layers where packet floods try to saturate a link. A flood of valid-looking HTTP requests is a Layer 7 application-layer attack, and for that you need a web application firewall. Microsoft expects you to run a WAF beside DDoS Protection, not instead of it.

What does the paid Azure DDoS tier add over the free one?

The paid tier profiles your application's normal traffic and tunes mitigation to that baseline. It adds attack analytics and telemetry, mitigation reports and flow logs, alerting at the start and stop of an attack, cost-protection credit for forced scale-out, and access to Microsoft's DDoS Rapid Response team during an active attack.