Azure networking costs are the quietest, most under-audited line item in enterprise Azure spend. On most tenants we audit, networking accounts for 8–15% of total invoice — not because traffic volumes are extreme, but because the architecture pays Microsoft three or four times for the same byte: once for egress out of the VNet, again for cross-region replication, again for NAT Gateway processing, and once more for Private Link per-endpoint hourly billing. The six dominant cost drivers are inter-region egress, internet egress, NAT Gateway data-processing fees, ExpressRoute port + circuit charges, Standard Load Balancer rule-and-data charges, and Private Link endpoint fees. Done right, an architecture review cuts networking spend 25–45% with no application code changes.
Why Azure networking costs hide
Three structural reasons explain why azure networking costs escape every standard FinOps review. First, the unit prices are tiny — pennies per GB, a few cents per hour — which makes individual line items look trivial in Cost Management. Second, the line items are spread across more than a dozen meters: Bandwidth - Inter-region, Bandwidth - Internet Egress, NAT Gateway - Data Processed, Standard Load Balancer - Rules, ExpressRoute - Data Transfer, and so on. Few finance teams roll them up. Third, the architecture choices that drive networking spend (hub-and-spoke topology, multi-region active-active, cross-region replication for resilience) are made by the platform team for technical reasons and rarely re-examined in cost terms.
The result: networking quietly compounds into the third-largest Azure line item on most enterprise tenants, behind compute and storage and sometimes ahead of databases. On a $20M annual Azure spend, $2–3M of networking is normal — and at least $600K–$1.2M of that is structurally optimisable.
Inter-region and internet egress — the dominant cost
Azure egress charges follow two meters that account for 40–60% of total networking spend on most tenants.
- Internet egress: data leaving Azure to the public internet. Tiered pricing from ~$0.087/GB (first 10 TB) down to ~$0.05/GB (above 150 TB) in North American regions, with higher rates in Asia-Pacific.
- Inter-region egress: data crossing Azure regions inside the same continent (~$0.02/GB) or across continents (~$0.05–$0.08/GB).
- Intra-region cross-AZ: free for VNet peering within the same region (changed mid-2024 in customer's favour, often missed by older architectures).
The most expensive pattern we see: active-active multi-region applications that replicate every write across regions synchronously, then read from the local region. The replication traffic is pure inter-region egress and is often 3–5x the actual user traffic. Audit your highest-egress applications first: a single chatty replication pipeline can drive $40K–$120K of monthly egress on its own.
Azure does not charge for ingress. Microsoft incentivises you to put data in, then charges to move it out — including out to another Azure region. The financial gravity of egress is real and structural: every petabyte parked in Azure becomes harder to leave without paying the egress toll. The 2024 EU Data Act forced Microsoft to waive egress fees for full-tenant exits, but day-to-day cross-region replication still incurs the full charge. Architecture decisions that minimise unnecessary cross-region movement are the only durable mitigation.
NAT Gateway data-processing fees
NAT Gateway pricing has two meters: a per-hour resource charge (~$0.045/hr) and a per-GB data-processing charge (~$0.045/GB) on top of the underlying egress charge. The data-processing fee is the killer. Any high-volume outbound workload routed through NAT Gateway pays twice: once for the data-processing and once for the egress.
The optimisation pattern: use NAT Gateway only where you actually need source-NAT semantics (typically: outbound API calls from container workloads where you need a stable outbound IP for partner allow-lists). For VMs that need outbound internet, Standard Load Balancer outbound rules are cheaper. For VMs that need no inbound access, default outbound is being deprecated — plan the migration to explicit outbound architecture before September 2026 to avoid being defaulted into NAT Gateway pricing by Microsoft.
ExpressRoute port and circuit charges
ExpressRoute is the dedicated private connection from on-prem to Azure. Two pricing models, both expensive at scale:
- ExpressRoute Local: data-transfer charges in-region only. Cheap if your on-prem datacenter sits next to an Azure region.
- ExpressRoute Standard: per-port hourly + included data; egress meter when included tier is exceeded.
- ExpressRoute Premium: global reach across all Azure regions; significantly higher per-port hourly.
Premium is the trap. Most enterprises buy Premium because the Microsoft account team frames it as the "enterprise tier", but Premium is only required if you genuinely need cross-region traffic over a single circuit. If your geographic footprint is one or two regions, Local or Standard is the right SKU and saves 30–50% on the port charge alone.
Standard Load Balancer — the per-rule trap
Standard Load Balancer prices three meters: a base hourly charge ($0.025/hr per first 5 rules), per-additional-rule charge ($0.01/hr above 5), and per-GB data-processed (~$0.005/GB). Architectures with many small services behind a single SLB accumulate dozens of rules and millions of GB processed. The optimisation: consolidate rule sets where ports overlap, prefer Application Gateway for HTTP/HTTPS where its built-in WAF replaces a separate Azure Firewall, and use Gateway Load Balancer only where genuinely required (NVA insertion patterns).
Private Link endpoint fees
Private Link gives PaaS resources (Storage, SQL DB, Key Vault) a private VNet IP. Each private endpoint costs ~$0.01/hr ($7.30/month per endpoint) plus per-GB inbound/outbound data-processing fees (~$0.01/GB each direction). On a tenant with hundreds of PaaS resources and Private Link enabled everywhere "for security", we routinely see $30K–$80K of monthly Private Link spend.
Audit which PaaS resources genuinely need Private Link versus those where service endpoints (free) provide adequate network isolation. Storage accounts holding non-sensitive data, Cosmos DB instances inside dev/test, and Key Vaults inside isolated subscriptions are common over-provisioned cases.
VNet peering — intra-region versus global
VNet peering charges per GB processed in each direction: ~$0.01/GB intra-region, ~$0.02/GB global. Hub-and-spoke topologies amplify this because every spoke-to-spoke flow transits the hub, paying twice (spoke-to-hub, hub-to-spoke). The optimisation: enable transit only where required; for chatty spoke-to-spoke workloads, prefer direct peering rather than routing through a central hub.
Anonymised case study: $1.4M networking cut
A global manufacturing client with $34M annual Azure spend was paying $3.2M/year on networking — 9.4% of total. The audit found: $890K/year on inter-region replication for a CMS that had no active-active requirement (the secondary region was DR-only and could replicate asynchronously); $310K/year on NAT Gateway data-processing for a workload that had been over-provisioned to NAT Gateway during a cloud-of-clouds migration without revisiting; $260K/year on ExpressRoute Premium when Standard would have served the two-region footprint; $180K/year on Private Link endpoints attached to non-sensitive storage. The remediation cut $1.4M of annual networking spend in 14 weeks, no application changes. The savings flowed directly to the MACC burn position, repositioning the client's EA renewal from an over-commitment to a balanced commit.
The Microsoft Licensing Briefing — 3 minutes, every Friday
Independent analysis of Microsoft commercial moves, with implications for your EA and Azure commit. No vendor spin.
No spam. Unsubscribe any time.
Where to take this from here
Networking is the line item where the smallest architecture investment captures the largest unbudgeted savings. Sequence the work in dollar order: cross-region egress audit first (the largest single bucket), NAT Gateway right-sizing second, ExpressRoute SKU review third, Private Link rationalisation fourth, Load Balancer consolidation fifth. For the broader Azure cost picture, the complete Azure cost optimisation guide sequences networking alongside compute and storage. For commitment positioning, the Savings Plans vs Reserved Instances guide covers how the right networking architecture changes your compute commit floor. For EA renewal leverage, the EA tier collapse playbook shows how a cost-disciplined Azure footprint changes your negotiation position. If networking is symptomatic of broader Azure over-spend, our Azure & MACC Advisory covers commitment design and FinOps governance end-to-end. To benchmark your current Azure networking ratio against peers, request a no-cost discovery call.