Bandwidth and egress on Azure, where the quiet money goes.

This sits in the Azure cost cluster alongside private endpoints and network cost and the cross cloud view in egress fees across the four clouds. Read those for the private link tradeoffs and how Azure egress compares with AWS, GCP, and OCI.

How does Azure actually charge for bandwidth?

Start with the rule that catches everyone: ingress is free, egress is not. You can pour data into Azure at no transfer cost, which is exactly why teams underprice the exit. Internet egress is banded, so the effective rate per gigabyte falls as you move from the first tier into hundreds of terabytes a month, but the headline first band rate is what a small estate pays and it is far from trivial.

Then there is the geography. Data moving between two Azure regions is charged as outbound from the source region. Data moving between availability zones within a single region carries an inter zone charge that many architects forget exists, because zone redundant designs spread traffic across zones by default. A chatty microservice mesh that spans zones for resilience can generate a steady inter zone bill that never appears in any single design review.

Why is the gateway, not the data, often the bigger line?

Raw egress is metered per gigabyte, but the instruments that carry it are billed twice: an hourly resource charge for existing, plus a per gigabyte processing charge for the data they handle. NAT Gateway is the classic example. It runs around the clock at an hourly rate and then adds a processing fee on every gigabyte that passes through it. An estate with many small outbound calls, package pulls, telemetry, and third party API traffic, can pay more in NAT processing than in the underlying internet egress.

VPN Gateway and ExpressRoute follow the same shape. ExpressRoute gives you a private circuit with its own port and either a metered or unlimited data plan, and the right plan depends entirely on steady volume. A team on the metered plan with heavy and predictable transfer often overpays against the unlimited tier, and a team on unlimited with light traffic burns the fixed cost. The instrument is a decision, not a default.

Where do buyers lose money on cross region traffic?

Three patterns recur. First, geo redundant storage and cross region replication copy every write to a paired region, and that replication traffic is real bandwidth on the bill. For genuinely critical data it is worth it, but teams often enable geo redundancy estate wide as a reflex when locally redundant or zone redundant storage would meet the requirement at a fraction of the transfer.

Second, backups and disaster recovery replication run continuously and quietly. A recovery vault replicating to a secondary region moves data every day, and nobody reads the line until it is large. Third, analytics pipelines that pull from one region into a data platform in another pay egress on every run. Co locating the compute with the data, or staging through a region local cache, removes the charge entirely.

What can you do this week to cut egress?

Four moves, in order of payback. Pull a bandwidth breakdown from Cost Management filtered to the transfer and gateway meters, so you can see internet egress, inter region, inter zone, and gateway processing as separate numbers rather than one blur. Co locate chatty services in the same region and, where resilience allows, the same zone, to kill inter zone churn. Right size or remove gateways: if a NAT Gateway is processing telemetry that could exit through a service endpoint, or an ExpressRoute plan is mismatched to volume, the fix is one configuration change. And serve repeat external traffic through a content delivery edge so the origin egress is paid once rather than per request.

None of these break production. They change where data travels and which instrument carries it, which is the whole point: egress optimization is architecture, not a coupon.

A worked example

Where this fits the cost review

Bandwidth is one of the quiet Azure budget eaters, and the fix is architectural rather than a discount, so it belongs inside a full networking and storage review. We run that review as an independent buyer side advisory across AWS, Azure, GCP, and OCI, with zero provider commissions and a guarantee: we reduce your cloud spend or we reimburse our service fee.

For monthly buyer side analysis delivered to your inbox, subscribe to The Cloud Spend Navigator.