An Azure DDoS Protection plan enables Azure DDoS Protection Standard for public IP addresses associated with protected virtual networks. Unlike Basic protection, Standard requires an explicitly created plan. Standard adds dynamically set thresholds for each IP address, monitoring metrics, attack logs, and cost protection for qualifying autoscaling during verified attacks. section 3.4.1 section 3.4.2
Deploy and apply the plan with Azure CLI in Cloud Shell:
- Associate the plan with an existing VNet containing the public IP addresses to protect. section 3.4.2
- Validate the deployment and confirm that the plan covers the intended public IP addresses. section 3.4.2
Confirming an association
A successful plan response reports provisioningState as Succeeded. After association, its virtualNetworks collection contains the ID of the linked VNet, providing an operational check that protection was applied to the intended network.
