One of the paid tiers of Azure DDoS Protection, charged for each individual public IP it covers. Mitigation works the same way as in the Network Protection tier; what's missing is rapid response support, the cost protection benefit and reduced WAF pricing.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains DDoS IP Protection in context, with comparison tables and the common traps.
Terms in this definition
- Azure DDoS Protection
Azure defence for public IP addresses against volumetric and protocol-level DDoS attacks. Paid tiers (DDoS Network Protection and DDoS IP Protection) build on the basic infrastructure protection that comes free.
- Network protection
Brings SmartScreen protection to every process on a device, so Defender for Endpoint can stop outbound connections to IP or URL indicators and to domains with a poor reputation. It is part of attack surface reduction and acts once the TCP handshake has finished.
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Web Application Firewall
Protection at layer 7 from OWASP Top 10 threats like XSS and SQL injection, available on Application Gateway or Front Door.
Related terms
- DDoS infrastructure protection
Baseline DDoS defence applied automatically at no charge to every Azure service with public IPs, needing nothing to be set up. For protection tailored to your own resources, the paid DDoS IP Protection and DDoS Network Protection tiers go further.
- DDoS Rapid Response
Microsoft's DDoS specialists, available to DDoS Network Protection customers while an attack is happening, who help investigate it and analyse it afterwards. DDoS IP Protection does not give access to them.