An Azure Private Endpoint puts a private IP address from your virtual network in front of a PaaS service such as Storage, SQL Database, or Key Vault, so traffic to that service stays on the Microsoft backbone and never traverses the public internet. The security and compliance benefit is the usual reason to adopt them, but they are not free. A Private Endpoint bills an hourly charge for as long as it exists plus a per gigabyte data processing charge on the traffic that flows through it, in both the inbound and outbound direction. That means the cost question is about volume and alternatives. For traffic that would otherwise leave the network and incur internet egress, or route through a NAT gateway, a Private Endpoint can be cheaper as well as more secure because it keeps the traffic private. For very high volume access to a service that also offers a free service endpoint, the per gigabyte processing charge on the Private Endpoint can make it the more expensive option, and a service endpoint may meet the requirement at no data charge. The right call depends on the security requirement, the traffic volume, and which alternative the traffic would otherwise take, so model it rather than rolling Private Endpoints out everywhere by default.
Here is how Private Endpoints are priced, how they compare with service endpoints, and when each one is the cheaper choice.
How are Azure Private Endpoints priced?
A Private Endpoint has two cost components. The first is an hourly charge billed for every hour the endpoint exists, regardless of traffic, which is small per endpoint but adds up across a large estate with many endpoints per service and per subnet. The second is a data processing charge per gigabyte on the traffic that passes through the endpoint, applied to both inbound and outbound flows. There is no separate charge for the private DNS zone records, but you do pay for the underlying service usage and any associated private link resources. The figures are indicative and vary, so confirm them on the Azure pricing page, but the shape is what matters: a fixed hourly cost plus a per gigabyte processing cost on throughput.
Private Endpoint or service endpoint, which is cheaper?
Azure offers two ways to reach a PaaS service privately, and they price very differently. A service endpoint extends your virtual network identity to the service over the Azure backbone at no additional data charge, but the service still has a public endpoint and the access is at the subnet level. A Private Endpoint gives the service a private IP inside your network, removing the public endpoint entirely, but charges the hourly and per gigabyte processing fees. So for pure cost on high volume traffic, a service endpoint is often cheaper. The reason to choose a Private Endpoint is when you need the service to have no public endpoint at all, private DNS resolution, or access from on premises over a private link, security and architecture requirements that a service endpoint cannot meet. Choose on requirement first, then cost.
| Aspect | Service endpoint | Private Endpoint |
|---|---|---|
| Data charge | None | Per gigabyte processing, both directions |
| Hourly charge | None | Yes, per endpoint |
| Public endpoint | Remains | Removed |
| Scope | Subnet level | Private IP in your network |
| On premises access | No | Yes via private link |
When does a Private Endpoint actually save money?
A Private Endpoint can be the cheaper option when it replaces a more expensive path. Traffic to a PaaS service that would otherwise route out through a NAT gateway, which bills its own hourly and per gigabyte processing charge, or that would otherwise incur internet egress, can come out ahead on a Private Endpoint because the traffic stays private and skips those charges. It also avoids the cross region egress that public routing can introduce when a service responds from a different region. The saving is real where the Private Endpoint displaces a NAT gateway or egress path; it is negative where it sits in front of traffic that a free service endpoint would have carried at no data charge. The displacement, not the endpoint itself, is what creates the saving.
How do you avoid the quiet inflation?
Three habits keep Private Endpoints from bloating the bill. First, do not roll them out by default on every service in every subnet, since each endpoint carries an hourly charge whether or not it is needed, and consolidate where one endpoint can serve a requirement. Second, read the data processing meter in the amortised cost export to see how much per gigabyte processing you are paying and on which flows, then move very high volume internal traffic to a service endpoint where the security requirement allows. Third, decommission Private Endpoints for retired services, since orphaned endpoints keep billing their hourly charge indefinitely, the same way orphaned disks and public IPs do. The sibling note on bandwidth and egress on Azure, linked below, sets this in the wider network picture.
How does this fit the wider Azure network bill?
Private Endpoints are one piece of a network line that also includes egress, NAT gateway processing, cross region traffic, and content delivery. Read all of these together in the cost export rather than optimising one in isolation, because moving traffic off one path often moves it onto another. The aim is to satisfy the security requirement at the lowest total network cost: Private Endpoints where the no public endpoint requirement is real or where they displace a pricier path, service endpoints where the requirement is lighter and the volume is high, and disciplined cleanup of anything orphaned. Decide each on requirement and modelled volume, not on a blanket policy.
A worked example
A European SaaS company adopted Azure Private Endpoints across every PaaS service in every subnet for a security baseline, then saw its network line climb without understanding why. The amortised cost export showed the data processing charge on a handful of very high volume storage flows, plus dozens of low traffic endpoints each billing an hourly charge. Keeping Private Endpoints where the no public endpoint requirement was genuine, moving the highest volume internal storage traffic to service endpoints where policy allowed, and decommissioning endpoints for retired services cut the network line materially while preserving the required private access. Figures are verified against billing data and anonymised.
Frequently asked questions
Do Azure Private Endpoints cost money?
Are Private Endpoints or service endpoints cheaper?
Can a Private Endpoint reduce my Azure network cost?
Right size your Azure private connectivity
We help Azure teams model Private Endpoint and service endpoint costs against the security requirement, move high volume flows to the cheaper private path, and clean up orphaned endpoints, across AWS, Azure, GCP, and OCI. We take zero provider commissions and answer only to you, on a Fixed Fee or a no risk Gainshare basis, with a simple guarantee: we reduce your cloud spend or we reimburse our service fee. Download the network playbook, and read the full Azure method below.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.