Free Download White Paper

The Azure Egress Trap — 7 Charges Microsoft Counts On You Ignoring

Compute and storage get the attention; data egress is where the Azure bill quietly balloons and the lock-in hardens. Egress charges are small per gigabyte, invisible until they aggregate, and structured so that the more data you put in Azure, the more expensive it becomes to take any of it out. This 22-page report breaks down the seven Azure egress charges enterprises routinely miss, shows where data-transfer cost turns into genuine vendor lock-in, and gives you the architecture and contract moves that cut both before your next renewal.

22Pages
PDFFormat
2026Edition
FreeNo payment required

Written for cloud architects, FinOps teams, and IT finance who suspect their Azure data-transfer line is bigger than it should be — and want it itemised. No spam. Unsubscribe anytime.

Download the Report

Enter your details for immediate access. Your information is never shared or sold.

By downloading, you agree to receive occasional Microsoft licensing intelligence from Microsoft Negotiations. Unsubscribe at any time.

Joined 2,400+ IT, legal, and procurement professionals who rely on our buyer-side research

Est. 2016 · 500+ engagements · $2.1B managed · 32% avg cost reduction · 100% independent · 100% buyer-side.

What's Inside

Seven egress charges. Where your Azure data-transfer bill actually comes from.

Egress is priced to be ignored — fractions of a cent per gigabyte, buried in a single "bandwidth" line that never names what drove it. Each of these seven charges is a separate meter, and most enterprises are paying several at once without seeing them itemised. The report breaks down all seven and gives the move that cuts each.

01

Internet Egress — The Headline Charge

Data leaving Azure for the public internet is billed per gigabyte on a tiered rate that barely drops as volume grows. It is the charge everyone knows exists and almost no one forecasts accurately, because the meter runs on every API response, file download, and backup copy that crosses the boundary. Where the tiers break and why your effective rate rarely improves.

02

Cross-Region Replication and Transfer

Moving data between Azure regions — for geo-redundant storage, multi-region apps, or DR replication — is billed as egress from the source region. Architectures designed for resilience quietly generate continuous transfer charges, and the more redundant the design, the larger the meter. How to tell resilience spend from waste.

03

Cross-Availability-Zone Traffic Inside One Region

Even traffic that never leaves a region is metered when it crosses availability zones — the inter-zone charge that surprises teams who assumed "same region" meant free. Chatty microservices and zone-spread clusters can run this meter hard. The placement decisions that avoid paying to talk to yourself.

04

NAT Gateway and Processed-Bytes Charges

Outbound traffic through a NAT gateway is billed twice — once for egress and again as a per-gigabyte processing fee on every byte that passes through. High-throughput outbound workloads can pay more in NAT processing than in the egress itself. The charge that hides inside your networking bill, not your bandwidth line.

05

Private Link, VPN, and ExpressRoute Data Charges

Private connectivity is sold as the secure, "free-er" path — but Private Link has per-gigabyte processing, VPN gateways meter throughput, and ExpressRoute splits into metered and unlimited plans with very different economics at scale. Which private path is actually cheaper for your volume, and where the metered tiers quietly win for Microsoft.

06

The Data-Out-to-Leave Charge — Egress as an Exit Tax

The charge that turns cost into lock-in: pulling your own data out of Azure to migrate to another provider or on-premises is billed as egress at full rate. The larger your estate, the more expensive the exit — by design. How egress functions as a switching cost, and the EU Data Act developments reshaping it.

07

CDN, Storage Read, and Service-to-Service Egress

The long tail: CDN origin-pull egress, storage account read/retrieval charges on cool and archive tiers, and service-to-service traffic between Azure products that bills as transfer. Individually small, collectively the difference between a forecast bandwidth budget and the number that actually lands on the invoice.

Critical Facts

Three reasons egress is the quietest lock-in mechanism Azure has

Egress isn't priced to punish you today — it's priced to make leaving expensive tomorrow. Each of these dynamics is covered in the report with the architecture and contract counter-move.

Mechanic One · the asymmetric meter

Data In Is Free; Data Out Is Not

Ingress to Azure is free, egress is metered. That asymmetry is deliberate: it makes putting data in frictionless and taking it out costly. The more you migrate in, the higher the standing balance of data you'd have to pay to move — so the switching cost grows automatically with every workload you add, without Microsoft raising a single rate.

Mechanic Two · the invisible line item

Seven Meters Report as One "Bandwidth" Charge

Internet egress, inter-region, inter-zone, NAT processing, private-link, and the rest aggregate into a handful of opaque line items that never name the workload that drove them. You cannot optimise what you cannot attribute — and the default invoice is built so you can't. Itemising the meters is the first move, and most teams have never done it.

Mechanic Three · the exit tax

Leaving Costs More the Longer You Stay

Egress charges turn a portability question into a budget question. A multi-petabyte estate can face a seven-figure transfer bill simply to repatriate or move to another provider — which is exactly why the option is rarely exercised. Regulatory pressure (the EU Data Act) is starting to erode this, and the report covers what is and isn't changing.

Preview

Full table of contents

This report is for the team that owns the Azure bill and suspects the data-transfer line is bigger than it should be. It assumes you know your architecture and want the cost mechanics behind egress, not an introduction to cloud networking.

It reflects the 2026 Azure egress landscape — the current data-transfer pricing structure, the NAT and private-link processing meters, and the early effects of the EU Data Act on switching and egress fees — so the guidance matches the invoice you're actually receiving.

Related resources: our Azure cost management service, the Microsoft IaaS licensing guide, and our broader Microsoft cost reduction practice.

Table of Contents

22 pages · PDF
01How Azure Egress Is Metered — The Seven Charges in Fullpp. 3–7
02Attributing the Bandwidth Line — Itemising What You Paypp. 8–11
03Architecture Moves That Cut Egress at the Sourcepp. 12–15
04Egress as Lock-In — The Exit Tax and the EU Data Actpp. 16–18
05The Contract Moves — Egress Waivers, Commitments, and MACCpp. 19–22
43%Of a media firm's "bandwidth" line that turned out to be inter-region and NAT processing charges, not internet egress
$1.3MAnnual egress reduction after re-architecting cross-region replication and consolidating availability-zone traffic

"Our Azure data-transfer cost had crept past a million a year and finance wanted it explained. When we finally itemised it, less than half was actual internet egress — the rest was cross-region replication we'd over-engineered and NAT processing on traffic that didn't need to go through the gateway. Fixing the architecture cut it by more than a third, and we negotiated an egress allowance into the next commitment on top."

Head of Cloud Engineering, Digital Media Group

Itemise the bandwidth line before it becomes an exit tax.

Egress only stays expensive while it stays invisible. Our advisors attribute every meter on your Azure data-transfer bill, fix the architecture driving it, and negotiate egress allowances into your commitment — so the cost stops growing and leaving stays an option.

Get a Free Azure Review Azure Cost Management Cost Reduction Practice