Save the date - January 26, 2026 - AMA: Best practices for applying Zero Trust using Intune
Join us on January 26 at 10:00 AM PT, to Ask Microsoft Anything (AMA) and get the answers you need to implement the right policies, security settings, device configurations, and more. Never trust, always verify. Tune in for tips and insights to help you secure your endpoints using Microsoft Intune as part of your larger Zero Trust strategy. Find out how you can use Intune to protect both access and data on organization-owned devices and personal devices used for work. Go to aka.ms/AMA/IntuneZeroTrust and select "attend" to add this event to your calendar. Have questions? Submit them early by signing in to Tech Community and posting them on the event page!
No free Azure DDOS protection tier anymore, is everyone in Azure susceptible to attack now?
Hi, From what I recall the 'Basic' Azure DDOS tier is no more. Instead, we now have the "network" and "ip" protection Azure DDOS tiers (all paid services). Does this imply that by default, if one does not purchase any of these new plans, an Azure network is therefore not protected against a DDOS attack? Thanks, SK https://azure.microsoft.com/en-us/pricing/details/ddos-protection/New Blog Post | Exclude Public IP addresses in Azure DDOS network protection
Full Article: Exclude Public IP addresses in Azure DDOS network protection - Microsoft Community Hub Azure DDOS network protection provides security for services deployed in virtual networks against volumetric attacks by way of always-on traffic monitoring and adaptive real time tuning. This may be achieved by applying DDOS protection plans to the different virtual networks in the different architectural tiers such as the Hub and Spoke network, Windows N-tier and Paas Web App architectures. Management of Azure services involves careful planning around available resources. One capability that is often requested by Azure DDoS protection customers is the ability to exclude certain public IP addresses from the protection plan to accommodate their prioritized workloads. For instance, public IPs attached to services in hybrid networking may be protected by DDoS plans in the hub or in the spoke virtual network depending on the type of architecture in use and the Public IP tier. A security administrator might also opt to use a DDoS IP protection SKU for certain workloads over DDoS Network protection.New Blog Post | Zero Trust with Azure Network Security
Read the full article here: Zero Trust with Azure Network Security - Microsoft Community Hub As more organizations continue to migrate workloads into the cloud and adopt hybrid cloud setups, security measures and controls can become complicated and difficult to implement. The zero-trust model assists and guides organizations in the continuous digital transformation space by providing a reliable framework to manage complexity, secure digital assets and manage risk. The Zero Trust model assumes breach and verifies each request as though it originated from an uncontrolled network regardless of where the request originates or what resource it accesses, instead of believing everything behind the corporate Firewall is safe. For this blog, we will guide you through strengthening one of Zero trust principles - Assume breach. To read more about Zero Trust principles see Zero Trust implementation guidance | Microsoft Learn Azure Network Security Solutions – Firewall, DDoS Protection, and Web Application Firewall (WAF) provide Zero Trust implementation at the network layer ensuring that organizations’ digital assets are secured from attacks and there is visibility into the network traffic. In this blog, we will look at how Azure DDoS Protection, Web Application Firewall and Azure Firewall can be deployed to achieve Zero Trust. The deployment is set up with end-to-end TLS encryption showcasing the ability of WAF and Azure Firewall to inspect encrypted traffic.New Blog Post | Azure DDoS IP Protection is Now Available in Public Preview
Read the full article here: Azure DDoS IP Protection is Now Available in Public Preview - Microsoft Community Hub IP Protection is a new SKU for Azure DDoS Protection that is designed with SMBs in mind and delivers enterprise-grade, and cost-effective DDoS protection. You can defend against L3/L4 DDoS attacks with always-on monitoring and adaptive tuning that ensure your application is always protected. With IP Protection, you now have the flexibility to enable protection on a single public IP. Azure DDoS Protection integrates seamlessly with other Azure services for real-time alerts, metrics, and insights to strengthen your security posture. If you have only a few public IPs in your environment, then you can start with IP protection SKU which can be enabled directly on the Public IP resource, and you only pay for that protected resource. The cost is a fixed 199$/month for each public IP resource protected with no additional variable costs. Prices may vary by region. Billing for IP Protection will be effective starting on February 1, 2023. Please see full detailed pricing list here Azure DDoS Protection Pricing | Microsoft AzureNew Blog Post | Azure DDoS Standard Protection Now Supports APIM in VNET Integration
Azure DDoS Standard Protection Now Supports APIM in VNET Integration - Microsoft Community Hub Azure DDoS Protection Standard provides enhanced DDoS mitigation features to defend against volumetric and protocol DDoS attacks, such as Adaptive real time tuning, always-on traffic monitoring, Azure DDoS Rapid Response support, cost protection telemetry, monitoring, and alerting. DDoS protection standard currently supports Public IPs in ARM based VNets such as Load Balancers, Bastion, Azure Firewall and Application Gateway. Now you can also protect your public IPs attached to VNet integrated Azure API Management (APIM) instances with Azure DDoS Protection Standard.New Blog Post | Anatomy of a DDoS amplification attack
Anatomy of a DDoS amplification attack - Microsoft Security Blog Amplification attacks are one of the most common distributed denial of service (DDoS) attack vectors. These attacks are typically categorized as flooding or volumetric attacks, where the attacker succeeds in generating more traffic than the target can process, resulting in exhausting its resources due to the amount of traffic it receives. In this blog, we start by surveying the anatomy and landscape of amplification attacks, while providing statistics from Azure on most common attack vectors, volumes, and distribution. We then describe some of the countermeasures taken in Azure to mitigate amplification attacks.New Blog Post | Improve your Azure Network Infrastructure Security with Complementary Services
Improve your Azure Network Infrastructure Security with Complementary Services - Microsoft Tech Community Given the rising number of cyber-attacks and data breaches in recent times, security has become paramount. For a while now, it’s been clear that securing only your network’s perimeter is simply not enough. The idea that we can inherently trust systems or users in “internal networks” is a recipe for disaster. Not to mention, it’s likely that many of your systems and users are not even in an internal network anymore. In this ever-changing world, attackers are constantly finding new ways to exploit vulnerabilities. This is one of the reasons to consider the strategy of defense-in-depth: if there are multiple layers of protection in place and one of them fails, another security mechanism exists to stand in the way of an attack. Besides a multi-layered approach to security, having a Zero Trust mindset is important. We focus on three principles when pursuing Zero Trust practices: verify explicitly, use least privileged access, and assume breach.
Azure DDoS Standard Scrubbing
Hello guys, First time posting here, apologies if I'm missing something. Here is my question; I've read the documentation for DDoS protection and it says the following: "During mitigation, traffic sent to the protected resource is redirected by the DDoS protection service and several checks are performed, such as the following checks:... " Source: https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview We're working with a bank in South America and they're interested in our DDoS protection service, however they're asking me how we do this "scrubbing", how we redirect traffic and how this process looks like and what they need to do from their side when a DDoS attack is identified. Can you give me those details please? Thanks in advance, Edwin
