Azure DDoS Protection

Free allowance: No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it.
Verdict: fails: egressdata cannot be read back out at a usable rate or price
Cost: no price statedsee Price below
Identity: cardcard required, no phone
Binding limit: write-gatedprotection is enabled on an Azure virtual network and covers the public IPs of resources in it
Evidence: documented2 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	No free tier and no forwarding: the service is enabled on an Azure virtual network and protects the public IPs of resources inside it. unit none; metered on none
Price	unpublished
Limits	write-gated (binding) protection is enabled on an Azure virtual network and covers the public IPs of resources in it source
Binding	write-gated It cannot be the ingress for a service outside Azure at any volume, so 1 TiB/month never becomes the constraint.
Identity	card An Azure subscription with a virtual network and a public IP inside it.
Egress	No volume allowance applies: the product is a mitigation policy on a user's own Azure public IP, not a proxy with a traffic allowance.; ingress: none free allowance: none published
Interface	rest, cli a DDoS protection plan attached to a virtual network, or per-public-IP protection
Tooling	Azure portal, CLI or ARM/Bicep
Composes with	chains with an Azure VM, which already has the public IP being protected
Reliability	none recorded
Evidence note	documented The virtual-network scoping and the TCP and UDP mitigation policies are quoted from the page read. What it does not do is stated by what it protects, not by an explicit denial.
Parsed numbers	has-free-tier 0

Evidence 2

date	source	what it proved
2026-10-23	learn.microsoft.com/en-us/azure/ddos-protection/ddos-protect	It's automatically tuned to help protect your specific Azure resources in a virtual network.
2026-10-23	learn.microsoft.com/en-us/azure/ddos-protection/ddos-protect	Azure DDoS Protection applies three auto-tuned mitigation policies (TCP SYN, TCP, and UDP) for each public IP of the protected resource, in the virtual network that has DDoS enabled.

More fields 6

wg path	none
wg detail	It filters traffic addressed to an Azure public IP; it does not issue an address that forwards to an origin a user names.
ingress	none
volume stated	No volume allowance applies: the product is a mitigation policy on a user's own Azure public IP, not a proxy with a traffic allowance.
bytes transit	no
transit note	traffic goes to a user's own Azure public IP; nothing is forwarded on a user's behalf

Unknown values 2