Azure DDoS Protection
Protect your Azure resources and prevent distributed denial-of-service (DDoS) attacks.
OVERVIEW
Apply always-on monitoring and automatic DDoS network attack mitigation
- Apply adaptive threat intelligence that automatically detects and mitigates even the most complex DDoS attacks.
- Utilize massive DDoS mitigation capacity that scrubs traffic at the network edge before it impacts applications.
- Enable full visibility into DDoS attacks with actionable insights for quick responses.
- Execute easy-to-deploy, multilayered DDoS protection immediately helping safeguard all resources on Azure virtual networks upon enablement.
FEATURES
Secure your network with Azure DDoS Protection
Monitor your app traffic patterns for anomalies
Use adaptive tuning that compares actual traffic against thresholds defined in your DDoS policy.
Set up multilayer DDoS protection in minutes
Defend against a comprehensive set of network layer (layer 3/4) attacks, and from common application layer (layer 7) attacks with powerful and easy-to-enable tools.
Interoperate seamlessly with other Azure services
Provide comprehensive protection and performance with Azure Monitor, Microsoft Defender for Cloud, Microsoft Sentinel, and the full suite of Microsoft security services.
Eliminate critical business impact with rapid response
Call on the DDoS Protection rapid response team to help with investigation, custom mitigation, and analysis—within a 15-minute SLA.
Avoid unforeseen costs of DDoS attacks
Help reduce the costs of DDoS-related usage spikes, such as app-scaling charges and bandwidth surges.
Choose the service that’s right for you
Meet the protection and cost needs of your organization—whether it’s a small to medium-sized business or an enterprise—with Network Protection or IP Protection.
Security
Embedded security and compliance
34,000
Full-time equivalent engineers dedicated to security initiatives at Microsoft.
15,000
Partners with specialized security expertise.
>100
Compliance certifications, including over 50 specific to global regions and countries.
PRICING
Explore Azure DDoS pricing
Help protect your Azure resources from DDoS attacks, with no upfront commitments, no termination fees, and cost that scales with your cloud deployment.
RELATED PRODUCTS
Our products work better together
Plan infrastructure tailored to you
Build your network with purpose with a secure, performant, and cost-effective solution for your business needs.
CUSTOMER STORIES
See what customers are doing with Azure DDoS Protection
RESOURCES
Get started with Azure DDoS Protection
FAQ
Frequently asked questions
- Distributed denial of service (DDoS) is a type of attack where an attacker sends more requests to an application than the application is capable of handling. This depletes resources, affecting the application's availability and its ability to service customers. Over the past few years, companies have experienced a sharp increase in these attacks, which are becoming more sophisticated and larger in magnitude. DDoS attacks can target any endpoint that's publicly reachable through the internet.
- DDoS Protection products, combined with application design best practices, provide enhanced DDoS mitigation features to defend against DDoS attacks. It's automatically tuned to help protect your specific Azure resources in a virtual network. It has several advantages over the default platform-level DDoS protection, including logging, alerting, and telemetry. See DDoS Network Protection Overview for more details.
- DDoS Protection is zone-resilient by default, and managed by the service itself. No customer configuration is necessary to enable zone resiliency.
- Use the Azure DDoS Protection service in combination with a web application firewall (WAF) for protection both at the network layer (layer 3 and 4, offered by DDoS Protection) and at the application layer (layer 7, offered by a WAF). Offerings include Application Gateway WAF and other web application firewall apps available in Azure Marketplace.
- Public IPs in an Azure Resource Manager-based Azure Virtual Network are currently the only type of protected resource. Platform as a Service (PaaS) services (multitenant) are not supported. See About Azure DDoS Protection tier comparison for details.
- The metrics of an attack should be visible on the portal within 5 minutes. If your resource is under attack, other metrics will start showing up on portal within 5 to 7 minutes.
Next steps
Choose the Azure account that’s right for you
Pay as you go or try Azure free for up to 30 days.
Azure Solutions
Azure cloud solutions
Solve your business problems with proven combinations of Azure cloud services, as well as sample architectures and documentation.
Business Solution Hub
Find the right Microsoft Cloud solution
Browse the Microsoft Business Solutions Hub to find the products and solutions that can help your organization reach its goals.