🛡️ Azure Public IP Address DDoS protection is not enabled🟢⚪

• Contextual name: 🛡️ Public IP Address DDoS protection is not enabled🟢⚪
• ID: /ce/ca/azure/public-ip/ddos-protection
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A public IP address is covered by Azure DDoS Protection through IP Protection, enabled on the address, or Network Protection, inherited from its virtual network. Its protection mode is Enabled, VirtualNetworkInherited or Disabled. Addresses DDoS Protection does not support, such as those on a NAT gateway, are out of scope.

Rationale

Without IP Protection or Network Protection, a public IP address relies only on Azure DDoS infrastructure protection, whose mitigation thresholds are set for the platform rather than the application. Attack traffic below those thresholds can still exhaust the bandwidth, connections, or compute behind the address, and no attack telemetry, alerting, or mitigation report is produced.

Audit

This requirement needs manual assessment. The collected protection mode does not establish inherited workload protection. Effective ddosProtectionStatus.isWorkloadProtected and supported-resource exclusions are not collected.

Remediation

Open File

Remediation

A public IP address is covered by Azure DDoS Protection through IP Protection, enabled on the address, or Network Protection, inherited from its virtual network. Its protection mode is Enabled, VirtualNetworkInherited or Disabled. Addresses DDoS Protection does not support, such as those on a NAT gateway, are out of scope.

For a supported Standard SKU public IP address, open Public IP addresses, select the address, and set DDoS protection > Protection type to IP. Alternatively, enable DDoS Network Protection on the associated virtual network and configure the address to inherit that protection. Basic SKU addresses and addresses from a public IP prefix linked to a public load balancer frontend require the network-protection path. Verify effective workload protection after applying the configuration.

Automated assessment is unavailable: The collected protection mode does not establish inherited workload protection. Effective ddosProtectionStatus.isWorkloadProtected and supported-resource exclusions are not collected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.5 Ensure Azure DDoS Protection is Enabled on Public IP Addresses (Automated)			1		no data
💼 Cloudaware Framework → 💼 Threat Protection			35		no data