Clarification Required: Azure DDoS Protection Applied at Public IP Level vs VNet Level and Billing Impact

Question

Clarification Required: Azure DDoS Protection Applied at Public IP Level vs VNet Level and Billing Impact

Abdulhadi Khalas 0

Hello Team,

I would like to clarify how Azure DDoS Protection Standard is currently applied in our environment and confirm the billing scope, as the cost appears to be calculated at the Virtual Network (VNet) level, while our understanding is that protection is enabled only on specific Public IP resources.

✅ Current Observations

Some Public IP addresses show DDoS Protection = Enabled

The Virtual Network (VNet) itself shows:

EnableDdosProtection = False

No DDoS Protection Plan associated at the VNet level

This indicates that DDoS protection is configured per Public IP, not at the network (VNet) level.

✅ PowerShell Validation

Public IP check:

Get-AzPublicIpAddress |

Select Name, @{Name="DDoS";Expression={$_.DdosSettings.ProtectionMode}}

✅ Result: Some Public IPs show ProtectionMode = Enabled

VNet check:

Get-AzVirtualNetwork |

Select Name, EnableDdosProtection, DdosProtectionPlan

✅ Result:

EnableDdosProtection = False

No DDoS protection plan linked to the VNet

✅ Questions for Confirmation

If DDoS Protection is enabled only on selected Public IPs (not on the VNet):

Should billing be calculated per protected Public IP?

Or does Azure still charge at the VNet / subscription level?

Is it possible that any hidden association or inherited configuration causes the cost to be calculated as if DDoS Protection is enabled at the network level?

What is the official and recommended method to:

Apply DDoS protection only to specific Public IPs

Ensure billing reflects IP-level protection, not full VNet protection?

✅ Objective

We want to ensure:

DDoS Protection is applied only where required

Billing accurately reflects the actual protection scope

No unintended VNet-level DDoS protection is enabled

0 comments

2 answers

Your answer

Answer 1

TP 163.9K Volunteer Moderator

Hi,

Please confirm you do not have any DDoS Protection plans. Simply having a plan will cause charges to accrue, even if you don't associate it with any VNets. You may check by navigating to below link in Azure portal:

https://portal.azure.com/#view/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/~/ddoSProtectionPlanItem

If you find a plan you should delete it to stop future billing.

Additionally, you may check in Azure Cloud Shell using below command:

Get-AzDdosProtectionPlan

The output should be blank if you do not have any plans. After deleting DDoS Protection plan(s), please periodically check in Cost Analysis to make sure charges have stopped accruing. They will continue to accrue for several hours after you delete the plan, but then should stop.

You should check to see if you are being charged for DDoS Network Protection plan and/or DDoS IP Protection. To do this you may navigate to Cost Management + Billing -- Cost management -- Cost analysis blade. Next click View -- Services at top, as shown below:

User's image

Once the entries are displayed, expand Azure DDOS Protection, as shown below:

User's image

If you see Network Protection Plan for the Meter, that means you are being charged for DDoS Network Protection plan and you need to delete any DDoS Protection plan(s) as I described above. If Meter is IP Protection Resource, that means you are being charged for DDoS IP Protection.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Abdulhadi Khalas 0 Reputation points

2025-12-10T11:09:23.9933333+00:00

Hi TP,

Thank you for your response. However, the information provided does not address the question I raised.

I am not inquiring about how to delete a DDoS Protection plan — I am already familiar with that process. My question is specifically related to the billing behavior:

I currently have DDoS Protection applied only at the Public IP level, not at the VNet level, and I have already verified this in the Azure portal.

Additionally, I double-checked using PowerShell to confirm that no DDoS Protection plans are associated at the VNet level.

Despite that, the Cost Analysis in Azure is showing charges as if DDoS Protection is applied to the entire VNet, which leads to significantly higher billing.

My concern is to clearly understand why Azure is generating VNet-level DDoS charges when protection is applied only to a single Public IP, and how this billing logic works behind the scenes.

Could you please clarify how Azure determines and calculates these charges, and why the billing appears as though DDoS is enabled at the VNet scope?

Thank you.
TP 163.9K Reputation points Volunteer Moderator

2025-12-10T11:20:13.6033333+00:00

Did you confirm that you do not have any DDoS Protection plans in your subscription? This is critical.

The mere existence of a DDoS Protection plan will cause charges to accrue. You don't have to associate the plan with any VNets. In fact, you could have 0 VNets or Public IPs in your subscription and would still be billed $2,944 per month simply because a DDoS Protection plan exists.

And to your point, I am very familiar with how DDoS Protection is billed, which is why I focused in on whether or not you have any DDoS Protection plans, since you mentioned above that your costs are approximately $95/day.
TP 163.9K Reputation points Volunteer Moderator

2025-12-15T08:48:37.76+00:00

@Abdulhadi Khalas Any update? I added instructions for checking to see if you are being charged for DDoS Network Protection and/or DDoS IP Protection to my answer above.
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator

2026-01-19T14:06:41.1966667+00:00

Hello Abdulhadi Khalas

I see TP has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Answer 2

Hello Abdulhadi Khalas

it looks like you’re trying to clarify how Azure DDoS Protection works in your setup and how the billing is applied. Let’s break down your concerns:

DDoS Protection Application: From what you've described, DDoS Protection can be applied at both the Public IP and VNet levels. In your case, it seems the protection is configured at the Public IP level since the VNet indicates no protection is enabled.
Billing Implications: For billing, the costs generally depend on the DDoS Protection tier you've chosen. According to Azure’s guidelines:
- DDoS IP Protection is billed based on the number of public IP addresses protected.
- DDoS Network Protection is a flat fee covering up to 100 public IPs across subscriptions. For more than 15 IPs, the Network Protection tier may be more economical.
Since you observed that public IPs show as having DDoS Protection enabled while your VNet does not, it’s reasonable to expect that billing would reflect only the protected Public IPs.
Hidden Associations: There shouldn’t be any hidden configurations, but it's always a good practice to double-check if there are any shared resources or service configurations in the Azure portal.
Official Recommendations:
- To apply DDoS protection only to specific Public IPs, you should enable DDoS IP Protection directly on those public IPs. You can do this through Azure PowerShell or the Azure portal.
- Ensure that you’re monitoring your subscription for any unexpected charges and that you have the correct protection plans in place.

Follow-up Questions:

To provide you with the most accurate and tailored advice, could you clarify:

What specific tier of DDoS Protection do you currently have enabled?
Do you have any additional configurations in your VNet that might affect pricing or protection?
What specific actions have you taken to check for hidden associations at the VNet level?

Hopefully, this information makes things clearer! If you have any more questions or need further assistance, just let me know!

References:

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Abdulhadi Khalas 0 Reputation points

2025-12-10T09:54:49.59+00:00

Hello Ganesh Patapati,

Thank you for your detailed explanation.

Based on my understanding and verification, DDoS Protection is enabled only at the Public IP level, not at the Virtual Network level.

I have confirmed this using Azure PowerShell, which shows that DDoS Protection is applied to specific Public IP resources, while DDoS Protection is not enabled on the VNet.

However, my concern is related to billing. Despite the configuration being limited to the Public IP level, the daily charges appear to be calculated as if DDoS Network Protection is enabled, with costs reaching approximately $95 per day for this service.

My main questions are:

How can I accurately verify, from the billing or cost management perspective, that I am being charged only for DDoS IP Protection and not DDoS Network Protection?

Is there a specific way in Azure Cost Management or Billing to clearly distinguish between:

DDoS IP Protection charges, and

DDoS Network Protection flat-fee charges?

Could there be any hidden association, inherited configuration, or linked protection plan that might cause the service to be billed at the network level, even though it is not explicitly enabled on the VNet?

Are there any additional resources or dependencies that could implicitly trigger network-level billing for DDoS Protection?

To summarize:

✅ Configuration confirmed at Public IP level only (validated via PowerShell)

❗ Billing behavior appears to reflect network-level protection costs

❓ Seeking confirmation on how to definitively validate the billing scope and cost calculation

I would appreciate your guidance on how to conclusively confirm this from the billing side and ensure there are no unintended configurations affecting the cost.

Thank you for your support.

Best regards,