Azure DDoS Protection Basic provides free, platform-level protection for Azure resources against distributed denial-of-service attacks. It is built into Azure, so no setup is required. section 3.4.1
Incoming traffic to Azure public IP addresses is analyzed for malicious behavior using network- and transport-layer properties. Malicious traffic is dropped, while legitimate traffic continues, including genuine demand spikes such as holiday activity. section 3.4.1
Basic protection has important operational boundaries:
- Uses threshold values based on the average of aggregated traffic targeting an Azure region, rather than traffic observed separately for each public IP address. section 3.4.1 section 3.7
- Lacks the advanced visibility and flexibility available with Azure DDoS Protection Standard, including its monitoring, alerts, telemetry, and dynamically tuned thresholds. section 3.4.1 section 3.7
- Works as one layer of Azure defense alongside services such as Azure Firewall and Azure Web Application Firewall, which address different network and application security needs. section 3.1 section 3.7
Legitimate traffic surge
A holiday-season increase in visitors can raise traffic to a web application without causing legitimate requests to be dropped; traffic identified as malicious is dropped instead. section 3.4.1
