# Azure DDoS Protection Plan

> Azure DDoS Protection plans charge a significant fixed monthly fee that covers up to 100 protected resources, so the per-resource economics only work at scale. ZopNight discovers each plan with its protected-VNet count via Resource Graph and attributes the fixed fee, surfacing underused plans for consolidation review.

Source: https://zop.dev/integrations/azure/ddos-plan
Updated: 2026-08-19

---

DDoS Protection plans add enhanced mitigation for VNets at a significant fixed monthly fee covering up to 100 resources. A plan protecting only a handful of dev resources is heavily underutilized spend.

## One flat fee designed to be shared

A DDoS Network Protection plan bills a substantial fixed amount every month, and that single fee covers up to 100 protected public IP resources across every VNet enrolled in the plan, including VNets in every subscription under the same tenant. The pricing model assumes consolidation: one plan, spread across an organization's entire footprint, amortizes into a modest per-resource cost. Enrolled resource number 101 begins metering an overage, but the far more common failure is the opposite one: a plan carrying three or four resources, paying the same flat fee that could shelter a hundred.

## Protected-VNet counts as the utilization measure

Discovered via Azure Resource Graph with protected-VNet counts. Cost Management billing attributes the fixed fee, supporting consolidation review. A protection plan has no operational state to schedule, being a billing and policy construct that is always on by definition, so utilization is the whole question, and the VNet count answers it. ZopNight pairs each plan's fixed spend with how many resources actually shelter under it, turning "are we using this?" into an explicit ratio rather than an assumption buried in a network team's tribal knowledge.

## Duplicate plans across an organization

The waste patterns are organizational. Plan-per-subscription sprawl: teams each purchasing their own plan, unaware one tenant-wide plan covers them all. Every duplicate is a full flat fee for capacity the first plan already provides. Dev-only plans: protection bought for non-production VNets that face no meaningful exposure, where the mitigation posture of the Standard infrastructure tier would do. Post-migration remnants: a plan retained after its protected workloads moved regions or clouds, guarding an empty enrollment list.

## Reviewing protection plans in the portal

Azure portal → DDoS protection plans shows each plan and its protected resources. A plan whose protected-resource list is short, or empty, is a consolidation or cancellation candidate; merging enrollments into one plan preserves the protection while eliminating every duplicate fee.