Azure DDoS Network Protection pricing for multiple VNets

Sruthisha J M 0 Reputation points
2026-10-17T05:37:14.7366667+00:00

Hi Team,

I would like to clarify the pricing model for Azure DDoS Network Protection.

The pricing page states that DDoS Network Protection has a fixed charge of $2,944/month, which includes protection for up to 100 public IP resources.

Could you please clarify the following:

1.Is the $2,944/month charge per DDoS Protection Plan, or per VNet?

2.For example, if we have 10 VNets associated with a single DDoS Protection Plan and the total number of protected public IP resources across those VNets is less than 100, would the total DDoS Network Protection charge remain $2,944/month?

3.Can those VNets be across multiple subscriptions while using the same DDoS Protection Plan?

4.Apart from the $2,944/month base charge, are there any additional charges for associating multiple VNets with the plan?

5.Are there any other DDoS-related charges we should consider, such as charges for data processing, monitoring/logging, or any other associated services?

Azure DDoS Protection
Azure DDoS Protection

An Azure service that provides defense against distributed denial-of-service (DDoS) attacks.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. TP 164.7K Reputation points Volunteer Moderator
    2026-10-17T07:25:42.9+00:00

    Answers inline:

    Q1. Is the $2,944/month charge per DDoS Protection Plan, or per VNet?

    A1: It is per DDoS Protection Plan. The number of VNets doesn't matter

    Q2. For example, if we have 10 VNets associated with a single DDoS Protection Plan and the total number of protected public IP resources across those VNets is less than 100, would the total DDoS Network Protection charge remain $2,944/month?

    A2: Yes, the charge would be $2,944/month since you have fewer than 100 Public IPs protected

    Q3. Can those VNets be across multiple subscriptions while using the same DDoS Protection Plan?

    A3: Yes, the VNets can be in multiple subscriptions while using same DDoS Protection Plan, provided the subscriptions are all part of the same tenant

    Q4. Apart from the $2,944/month base charge, are there any additional charges for associating multiple VNets with the plan?

    A4: No

    Q5. Are there any other DDoS-related charges we should consider, such as charges for data processing, monitoring/logging, or any other associated services?

    A5: Yes, you may incur Azure Monitor charges. For example, sending data to Log Analytics workspace, alerts, notifications, may incur charges. Please see details on Azure Monitor pricing page

    Thanks.

    -TP

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-17T05:37:39.88+00:00
    1. The charge is per DDoS Network Protection plan, not per VNet. Network Protection uses a fixed monthly plan that covers up to 100 public IP addresses.
    2. Yes. If 10 VNets are associated with one DDoS Protection plan and the total protected public IP resources across those VNets is under 100, the charge remains the single fixed monthly plan charge. The documentation states that one plan can cover up to 100 public IPs across linked virtual networks in the tenant.
    3. Yes. A single DDoS protection plan can be used across multiple subscriptions under the same tenant. The documentation explicitly states there is no need to create more than one DDoS protection plan under a tenant for that reason.
    4. No separate charge is documented for associating multiple VNets with the same plan. The documented pricing model is the fixed monthly plan charge covering up to 100 public IPs, with overage charges beyond 100 protected public IPs.
    5. The documented DDoS-related pricing points in the provided material are:
      • Network Protection: fixed monthly charge covering up to 100 public IPs.
      • Additional protected public IPs beyond 100: charged as overage.
      • IP Protection: billed per protected public IP.
      • If IP Protection is enabled on a public IP and then a DDoS protection plan is created and enabled on its virtual network, billing automatically moves to Network Protection at the lower per-public-IP-resource rate described in the pricing guidance.
      • When Application Gateway with WAF is deployed in a DDoS-protected virtual network, there are no extra charges for WAF; Application Gateway is billed at the lower non-WAF rate.

    The provided material does not document additional DDoS-specific charges for data processing, monitoring, or logging beyond the pricing items above.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.