audit-ddos-protection.json

{
    "properties": {
        "displayName": "Enabled DDoS protection",
        "policyType": "Custom",
        "mode": "All",
        "metadata": {
            "category": "Network"
        },
        "parameters": {},
        "policyRule": {
            "if": {
                "allOf": [{
                    "field": "type",
                    "equals": "Microsoft.Network/virtualNetworks"
                }]
            },
            "then": {
                "effect": "AuditIfNotExists",
                "details": {
                    "type": "Microsoft.Network/virtualNetworks",
                    "name": "[field('name')]",
                    "existenceCondition": {
                        "allOf": [{
                                "field": "Microsoft.Network/virtualNetworks/enableDdosProtection",
                                "equals": "true"
                            },
                            {
                                "field": "Microsoft.Network/virtualNetworks/ddosProtectionPlan",
                                "notEquals": ""
                            }
                        ]
                    }
                }
            }
        }
    }
}