# Azure DDoS Protection Plan Cost Review

> Azure DDoS Protection plans protecting zero VNets are flagged for deletion, with the plan's full monthly cost as savings. Plans covering more than 5 VNets are treated as justified and skipped, and plans with 1 or more protected VNets abstain because no protected-public-IP count signal exists yet.

Source: https://zop.dev/integrations/azure/recommendations/azure-ddos-protection-plan-cost-review
Updated: 2026-08-19

---

## Counting the VNets attached to the plan

- metadata: protected_vnets (authoritative ARG summarize count() by planId of VNets referencing the DDoS plan, stamped by applyDDoSLookupSets). Read fail-closed: it abstains when absent or non-numeric. (The former getTagFloat(Tags,"protected_vnets") had no producer, returned −1, and fired the "absent" branch on every plan, which is FAILS_OPEN.) Plans protecting > ddosManyVNetsThreshold = 5 VNets are skipped (the fixed plan is justified).
- pricing (SetPricing) for the per-resource monthly cost.

## Why only the zero-VNet case gets a number

Only the 0-VNets branch fires: savings = cost (delete the pure-waste plan). Plans protecting 1+ VNets abstain unconditionally. The rule previously computed a per-IP downgrade delta as cost − (ddosIPProtectionMonthlyPerIP × nVNets), treating the VNet count as a stand-in for Azure's real billing axis (protected public IP count, break-even ~15 IPs). A VNet routinely fronts several public IPs (LB, App Gateway, VPN Gateway, Bastion, public-IP VMs), so that always understated the true per-IP cost, over-claimed the saving, and could even invert its sign (real per-IP cost exceeding the fixed plan) while still reporting a positive $ figure. No protected-public-IP-count signal is produced today, so the per-IP branch abstains (concrete-or-abstain) rather than ship that fabricated delta. ddosIPProtectionMonthlyPerIP (~$199/mo/IP) is retained in code only for the future rec once that signal exists.

## Deleting a plan nothing references

1. Review which VNets are protected by this DDoS plan
2. If none reference it, delete the plan to eliminate the fixed charge
3. DDoS IP Protection (~$199/mo/IP) may be cheaper for plans protecting few public IPs, but requires manual verification of the actual protected public IP count (not yet available as a signal)