Azure Compliance ControlsAzure DDoS Protection
Virtual networks should have Azure DDoS Protection Standard enabled
Virtual Network should have DDoS Protection Plan enabled. DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP. Azure Virtual Networks are evaluated for DDoS Network Protection.
What this control checks
Virtual networks must have Azure DDoS Protection enabled; a disabled DDoS protection plan fails.
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.20 Network security
- SC-5 Denial-of-service Protection
- 8.5 Ensure Azure DDoS Network Protection is enabled on virtual networks
- 6.6 Ensure that Network Watcher is 'Enabled'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_ddos_enabled - Powerpipe Control:
azure_compliance.control.network_ddos_enabled - Prowler Check:
network_vnet_ddos_protection_enabled - KICS Query:
b4cc2c52-34a6-4b43-b57c-4bdeb4514a5a
Last reviewed: 2026-10-13