Question

Your company runs several production workloads across multiple Azure subscriptions in a single tenant. Public-facing virtual machines and load balancers are exposed via standard public IPs. Management wants coordinated, tuned DDoS mitigation with attack analytics and cost protection for the resources in these VNets, while minimizing the number of plans purchased. What is the recommended approach to enable Azure DDoS Network Protection?

Accepted Answer

Create one DDoS Network Protection plan and associate multiple virtual networks (including those in other subscriptions of the same tenant) to that single plan.

Answer

Create a separate DDoS Network Protection plan in every subscription and associate each VNet to the plan in its own subscription.

Answer

Enable DDoS IP Protection on each individual public IP address, since Network Protection cannot span multiple VNets.

Answer

Rely on the always-on Basic DDoS infrastructure protection, which already provides tuned mitigation and per-resource attack analytics at no cost.