When planning IP addressing for subnets in Azure virtual networks, which type of resource requires individual IP addresses allocated from the subnet's address range?

Internal load balancers require individual IP addresses from a subnet's address range because they act as a central point for distributing incoming network traffic to multiple backend virtual machines. This IP address is the frontend IP configuration of the load balancer, which clients connect to. Azure DDoS Protection, service endpoint policies, and service endpoints are network features or configurations that enhance security or connectivity but do not consume individual IP addresses from a subnet's range themselves. DDoS Protection is a service applied to a virtual network, service endpoint policies define access rules, and service endpoints enable direct connectivity to Azure services over the Azure backbone, but none of these directly allocate IP addresses from your subnet.