Azure charges you when data leaves its data centers, not when it arrives. For US internet traffic, the first 100 GB a month is free, then the rate starts at $0.087 per GB and falls as volume grows. Moving data between regions and through some networking services carries separate charges. Most surprise bills come from traffic nobody mapped: a cross-region copy job, a chatty integration, a NAT gateway left running.
This guide shows what counts as egress, what the published rates look like, how to estimate your own number, and which fixes are worth the effort. It also covers the commitment discounts people often confuse with bandwidth savings: reserved instances and savings plans.
TL;DR
- Data coming into Azure is free. Data leaving to the internet, or moving between regions, is billed per GB, according to Microsoft's bandwidth pricing page.
- In Zone 1, which includes North America, internet egress is free for the first 100 GB a month, then $0.087/GB for the next 10 TB, with lower rates at higher volumes.
- The cheapest fixes are architectural: keep chatty components in the same region, cache with a CDN, and delete idle NAT gateways.
- Reserved instances and savings plans lower the price of compute. They are not a fix for bandwidth charges, so treat them as a separate decision.
Table of Contents
- What counts as egress on an Azure bill
- Current US rates and what they mean in dollars
- How to estimate your own egress before it surprises you
- Practical ways to reduce egress
- Reserved instances vs. savings plans: do they help with egress?
- Our perspective: fix the architecture before you negotiate the rate
- Where Mindpod can help
- FAQ
- Sources
What counts as egress on an Azure bill
Microsoft defines bandwidth as data moving in and out of Azure data centers, and between Azure data centers. Inbound transfer is free. Everything else depends on where the data goes.
Three categories cover most small-business bills:
- Internet egress. Data your VMs, storage accounts, web apps or databases send to users, partners or other clouds over the public internet.
- Inter-region transfer. Data moving between Azure regions. Microsoft lists $0.02/GB between regions within North America and $0.05/GB from North America to other continents.
- Private connectivity. ExpressRoute circuits have their own model. Microsoft's ExpressRoute cost documentation says inbound data is included on all SKUs, outbound data is included only on Unlimited plans, and Metered plans charge outbound data per GB based on peering location. Gateway hourly charges and other connectivity costs can apply on top.
The bandwidth line is only part of the story. Services that sit in the path, such as NAT gateways, load balancers and private endpoints, add their own hourly or per-GB processing fees. That is why a bill can show "networking" costs that do not match the gigabytes your users actually downloaded.
Current US rates and what they mean in dollars
The published Zone 1 internet egress schedule, for traffic routed over Microsoft's premium network, works like this:
| Monthly volume (Zone 1) | Rate |
|---|---|
| First 100 GB | Free |
| Next 10 TB | $0.087/GB |
| Next 40 TB | $0.083/GB |
| Next 100 TB | $0.07/GB |
| Next 350 TB | $0.05/GB |
The free allowance applies to all customers in all Azure regions. Microsoft also states that its prices are estimates and can vary by agreement, purchase date and currency exchange rate, so treat the page as the reference and your own invoice as the truth.
Worked examples
These are rough calculations using the rates above, counting 1 TB as 1,000 GB. Your invoice will differ slightly.
- 5 TB of internet egress in a month. After the free 100 GB, 4,900 GB at $0.087 comes to about $426.
- 20 TB in a month. After the free 100 GB, the next 10,000 GB at $0.087 is $870, and the remaining 9,900 GB at $0.083 is about $822. The total is roughly $1,692.
- 1 TB copied between two North American regions. 1,000 GB at $0.02 is $20. The same terabyte sent from North America to another continent is $50.
Notice what the examples show. A modest website rarely produces a painful egress bill. The expensive patterns are bulk data: backups copied across regions every night, analytics exports pulled to another cloud, media delivered straight from storage, or an application that fetches large datasets for each request.
How to estimate your own egress before it surprises you
A good estimate takes an afternoon, not a project. Work through it in this order.
- Find what you already pay. In Cost Management, filter by the bandwidth and networking meters for the last three months. Note which subscriptions and resource groups drive the cost.
- Map the flows. For each top resource, ask where its traffic goes: internet users, another region, another cloud, on-premises. Microsoft's networking cost-optimization guidance recommends using Azure Monitor and Network Watcher data flows to identify the expensive traffic.
- Apply the tiers. Subtract the free 100 GB, then multiply by the right rate for each path. Use the Azure pricing calculator for the final numbers, as Microsoft directs customers to do.
- Model ExpressRoute separately. Microsoft's documentation says to select Networking, then Azure ExpressRoute, choose the zone by peering location, pick the SKU, circuit speed and data plan, and enter expected outbound GB.
- Add a growth case. If volume doubles, which tier are you in and what happens to the bill? Egress scales linearly until the tiers kick in, so growth in a data-heavy product is worth modeling.
Keep the output as a one-page table: flow, monthly GB, rate, monthly cost, owner. When a number jumps next quarter, you will know where to look.
Practical ways to reduce egress
Order matters here. Start with the changes that cost nothing and carry no risk, then move to the ones that need engineering time.
Keep chatty components together
Microsoft's guidance is to minimize cross-region traffic and to colocate components when latency and data-residency requirements allow. It also suggests regional rather than global peering where possible. A common small-business pattern is an app in one region, a database in another because of an old migration, and a reporting tool in a third. Each hop is billable. Consolidating them can remove a whole line of the bill.
The trade-off is resilience and compliance. If you replicate across regions for disaster recovery, that traffic is intentional. Do not collapse it to save $20 a month. Do check that the replication schedule and scope match your recovery targets, and that you are not copying data nobody would restore. Our cloud architecture checklist walks through region and dependency decisions like this one.
Put a cache in front of public content
If users download images, documents, installers or video from storage or a web app, a content delivery layer can cut the bandwidth leaving your origin. Microsoft's comparison of the two services notes that data moving from an Azure origin to Front Door's edge is free, and that Front Door Standard carries a $35 monthly base fee while Premium is $330. Edge-to-user delivery is still billed per GB, at zone-based rates, so a CDN pays off when cache hit rates are high and the same files are requested repeatedly. It does little for unique, per-user responses.
Audit NAT gateways and idle networking
A NAT gateway costs a fixed hourly amount while it is provisioned, plus data-processing fees for traffic it handles in both directions, as a Microsoft Q&A thread on NAT gateway costs explains. Dev and test environments are the usual culprits. If the gateway is not needed overnight or between projects, delete it and recreate it from infrastructure as code. That only works if the environment is defined in code, so that is a good forcing function.
Move non-real-time work off the expensive path
For workloads that must stay in Azure, such as a real-time media service, community guidance suggests keeping the real-time piece in Azure and offloading batch work like transcription, inference or storage to cheaper infrastructure via asynchronous queues. The same thread is honest about the limits: for high-bandwidth real-time workloads there are few technical levers, and negotiated pricing in an enterprise agreement is described as the biggest one. Treat this as a design option to weigh, not a default. Moving data out to another provider triggers egress itself.
Compress and trim payloads
This is unglamorous and effective. Turn on compression for API and web responses, return only the fields a client needs, paginate large result sets, and stop exporting full tables when a delta would do. Scheduled jobs that pull a complete dataset every hour are common and expensive.
Right-size before you optimize anything else
Bandwidth often rises with oversized or duplicated environments. Our guide to cloud rightsizing for SMBs explains why a long observation window prevents bad cuts, and the Azure cost optimization runbook covers the wider checklist beyond networking.
Reserved instances vs. savings plans: do they help with egress?
People searching for egress savings often land on commitment discounts, so it is worth being clear. Reservations and savings plans reduce the price of compute you commit to. They do not change the per-GB price of data leaving Azure. Microsoft's rate optimization documentation frames them as ways to lower rates on eligible usage, not as a bandwidth tool, and savings plans in particular apply to compute rather than networking or storage.
Still, if you are cutting your Azure bill, you will face the decision. Here is how the two compare.
| Reservation (reserved instance) | Savings plan | |
|---|---|---|
| What you commit to | A specific resource type, SKU and location | A fixed hourly spend |
| Flexibility | Low: tied to that configuration | High: applies across eligible compute, types, SKUs and locations |
| Maximum discount per Microsoft | Up to 72% | Up to 65% |
| Best for | Stable, predictable workloads | Dynamic or evolving workloads |
The figures and the fit come from Microsoft's rate optimization page and its guide to deciding between a savings plan and a reservation. "Up to" matters: the real discount depends on the service, term and region.
When to use reserved instances
Use a reservation when you are highly confident a specific configuration will run steadily for the whole term: a production database server, a fixed pool of VMs behind a line-of-business app. The deeper discount rewards that certainty. Microsoft's advice is to start small with targeted, high-confidence decisions, because commitments carry the risk of under-utilization.
When a savings plan is the better call
Choose a savings plan when you expect to change VM families, shift regions, or move between services as you modernize. You commit to an hourly amount and the discount follows your usage across eligible compute. You give up some discount in return for room to change.
Watch the exchange change
Exchange rules are tightening. Microsoft states that reservations bought after February 1, 2027 for services that savings plans support will no longer be eligible for exchange, while reservations bought earlier keep one final exchange. If you are unsure about a configuration, that is an argument for a savings plan, or for buying a smaller reservation.
The right order of operations
Microsoft recommends right-sizing first, managing existing reservations next, and only then applying new commitments, so that savings are real rather than theoretical. Committing to an oversized VM locks in waste at a discount.
A note on Azure SQL
Database decisions follow the same logic. Serverless suits intermittent, unpredictable use, because compute scales with demand. Provisioned suits steady load, where a reservation can lower the rate further. If a database is busy around the clock, serverless adds little; if it sits idle most of the day, provisioned capacity wastes money. Check the current vCore and storage pricing on Microsoft's Azure SQL pages for your region before choosing, and keep database replication traffic in your egress map.
Our perspective: fix the architecture before you negotiate the rate
We see the same pattern with small and midsize teams. Someone notices a networking line growing, then goes shopping for a discount. The discount tools are real, but they sit at the end of the process. Egress is a design problem first.
Our approach is to start from the flows. Which system sends data where, how often, and why? Often a third of the traffic exists because of a decision nobody remembers: a region chosen during a migration, a nightly export that feeds a report nobody opens. Removing that traffic is cheaper than optimizing it.
We also push back on two instincts. The first is moving everything to a cheaper provider to avoid egress. Leaving Azure creates its own egress bill, plus migration risk and retraining, so the math has to include the exit. The second is cutting redundancy to save a few dollars. Recovery copies are meant to cost something. Decide the recovery target first, then pay for exactly that.
Finally, we like changes that are reversible and measured: tag the resources, change one flow, watch two billing cycles, keep a written record of what moved the bill. That record is yours to keep, in plain language, so your team does not depend on us to understand it.
— jaras
Where Mindpod can help
If your Azure bill has a networking line you cannot explain, our Cloud & Training work starts with a free technology assessment and a prioritized plan written in plain language that you own. From there we can deliver and run the changes with you.
FAQ
Is data transfer into Azure free?
Yes. Microsoft's bandwidth page states that inbound data transfer is free. Charges apply to data leaving Azure data centers to the internet, and to data moving between Azure regions or continents. Services in the path, such as NAT gateways, can add their own fees.
How much free egress do I get each month?
The first 100 GB a month of internet egress is free for all customers in all Azure regions. After that, Zone 1 traffic is billed at $0.087/GB for the next 10 TB, with lower rates at higher volumes. Check the bandwidth pricing page for your agreement and current rates.
Will a savings plan or reservation lower my egress charges?
No. Both commit you to compute usage, not bandwidth. They can still cut your total Azure bill, so decide on them separately: reservations for steady, known configurations and savings plans where your compute is likely to change. Right-size first so you do not commit to waste.
What is the fastest way to find where egress is coming from?
Filter Cost Management by the bandwidth and networking meters, group by resource, then use Azure Monitor and Network Watcher to see which flows are heavy. Look first at cross-region copies, public downloads served straight from storage, and NAT gateways in non-production environments.
Sources
- Pricing - Bandwidth, Microsoft Azure
- Azure Pricing Overview, Microsoft Azure
- Plan and manage costs for ExpressRoute, Microsoft documentation
- Virtual network cost optimization, Microsoft documentation
- Compare the pricing of Azure CDN Standard Microsoft and Azure Front Door
- How to fix NAT gateway costs, Microsoft Q&A
- Hosting Teams media bots in production, Microsoft Q&A
- Rate optimization, Microsoft Learn
- Decide between a savings plan and a reservation, Microsoft Learn
- Self-service trade-in for savings plans, Microsoft Learn