subscription level defender vs DDoS protection

Question

I am hosting a public-facing portal in an Azure subscription. If I have the latest Microsoft defender enabled on all resources within this subscription, do I still need DDoS protection? Thanks,

Answer 1

@Wang, Jane ,

Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.

Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyberattacks, and streamline security management. Services running on Azure are inherently protected by the default infrastructure-level DDoS protection. However, the protection that safeguards the infrastructure has a much higher threshold than most applications have the capacity to handle, and does not provide telemetry or alerting, so while a traffic volume may be perceived as harmless by the platform, it can be devastating to the application receiving it.

By onboarding to the Azure DDoS Protection Standard Service, the application gets dedicated monitoring to detect attacks and application-specific thresholds. A service will be protected with a profile that is tuned to its expected traffic volume, providing a much tighter defense against DDoS attacks.

So, the answer to your question depends on your application topology. DDoS by default is enabled for all Azure services, but if you want more personalized and advanced DDoS features then I recommend going for DDoS standard.

----------

Please "Accept as Answer" and Upvote if any of the above helped so that, it can help others in the community looking for remediation for similar issues.