Azure VPN Gateway pricing: gateway hours, tunnels and data transfer
Short version
- Two meters: the hours a gateway exists, and the gigabytes that leave it. There is no line for people.
- In East US, in US dollars, Basic is $0.036 an hour, VpnGw1AZ $0.21, VpnGw5AZ $4.02. At the 730-hour month Microsoft's own page assumes, that is $26.28 to $2,934.60.
- Ten site-to-site (S2S) tunnels and 128 point-to-site (P2S) connections ride inside the gateway hour. Beyond that, an S2S tunnel is $0.015 an hour and a P2S connection $0.01 an hour.
- Data out to the internet: the first 100 GB a month is free, then $0.087 per GB on the default routing.
- The pricing page draws its price cells in the browser. The hourly rates here were read the same day from Microsoft's Retail Prices API.
What one gateway hour costs
Read server-side, Azure's pricing page shows "$-" in every price cell. What did come through was the note that "Monthly price estimates are based on 730 hours of usage per month" and the columns showing how many tunnels and connections are included. For the hourly rates, this site queried the Azure Retail Prices API, which Microsoft publishes, for the same service name in the East US region. Everything below is USD, East US, read on 2026-10-02.
| SKU | Per hour | Per 730 hours | S2S tunnel limit | P2S limit (IKEv2/OpenVPN) |
|---|---|---|---|---|
| Basic | $0.036 | $26.28 | 10 | Not supported (SSTP only, 128) |
| VpnGw1 | $0.19 | $138.70 | 30 | 250 |
| VpnGw1AZ | $0.21 | $153.30 | 30 | 250 |
| VpnGw2 | $0.49 | $357.70 | 30 | 500 |
| VpnGw2AZ | $0.54 | $394.20 | 30 | 500 |
| VpnGw3 | $1.25 | $912.50 | 30 | 1,000 |
| VpnGw3AZ | $1.38 | $1,007.40 | 30 | 1,000 |
| VpnGw4 | $2.10 | $1,533.00 | 100 | 5,000 |
| VpnGw4AZ | $2.31 | $1,686.30 | 100 | 5,000 |
| VpnGw5 | $3.65 | $2,664.50 | 100 | 10,000 |
| VpnGw5AZ | $4.02 | $2,934.60 | 100 | 10,000 |
The limit columns come from the SKU table on learn.microsoft.com. The same document says the non-AZ VpnGw1 through VpnGw5 "are slated for migration and should not be used to create new VPN gateways," and recommends the zone-redundant AZ SKUs for new deployments. An AZ SKU costs $0.02 to $0.37 more per hour than its plain counterpart. Basic has no BGP, no zone redundancy and a 100 Mbps throughput benchmark.
The gateway hour runs with no tunnel attached and nobody connected. AWS's Client VPN endpoint behaves the same way (article-17); the difference is that Azure folds an allowance of tunnels and connections into that hour.
When tunnels and connections start costing extra
The pricing page's table reads "1-10 included" for S2S and "1-128 included" for P2S. The eleventh S2S tunnel onward is $0.015 an hour, or $10.95 per 730-hour month. The 129th P2S connection onward is $0.01 an hour, or $7.30 a month.
The SKU ceiling can arrive first. Basic tops out at 10 S2S tunnels, so it never reaches the surcharge. VpnGw1AZ allows 30, so tunnels 11 through 30 carry the hourly rate.
What data transfer costs
The learn.microsoft.com overview puts it in three lines: traffic to your on-premises VPN device is billed at the internet egress rate; traffic between virtual networks in the same region is free; traffic between regions is priced by region. Inbound is free.
For internet egress from East US on the default "Microsoft global network" routing, the first 100 GB in a month is $0, then $0.087 per GB. Past roughly 10 TB the rate steps down to $0.083, and lower tiers follow. Choosing "Routing Preference: Internet" instead prices the same traffic at $0.08 per GB after the free 100 GB; this article uses the default.
A month for a ten-person remote team (P2S)
Assumptions, stated: one VpnGw1AZ for 730 hours; ten people connecting over point-to-site VPN; 200 GB a month flowing from the gateway out to those ten.
- Gateway: $0.21 x 730 = $153.30
- Ten P2S connections: inside the 128 allowance, $0
- Data transfer: 200 GB minus 100 GB free = 100 GB x $0.087 = $8.70
- Total: $162.00, which is $16.20 per person across ten
Put the same assumptions on Basic and the month is $26.28 + $8.70 = $34.98, or $3.50 per person, with the caveats that Basic's P2S is SSTP only (no IKEv2, no OpenVPN) and it is not zone-redundant. Neither per-person figure is a price Azure publishes; both are this article's assumptions divided by ten.
The business VPNs in this site's per-user rankings turn a headcount into a bill. Nothing here takes a headcount; it takes gateway hours and gigabytes. Twenty people instead of ten, with the same traffic and still under 128 connections, pay the same.
A month for an office-to-cloud S2S link
Assumptions: one VpnGw1AZ for 730 hours; one tunnel to the office router; 1,000 GB a month leaving the cloud for the office.
- Gateway: $0.21 x 730 = $153.30
- One S2S tunnel: inside the 10 allowance, $0
- Data transfer: 1,000 GB minus 100 GB = 900 GB x $0.087 = $78.30
- Total: $231.60
On Basic, $26.28 + $78.30 = $104.58. One tunnel with no need for BGP stays within Basic's limits. Grow to eleven branch offices on VpnGw1AZ and the eleventh tunnel adds $10.95 a month, as does each one after it.
Same structure as AWS?
In article-17, AWS charged $0.05 an hour for a Site-to-Site connection plus $0.05 an hour for the Transit Gateway attachment, with data at $0.09 per GB after 100 GB free. Azure charges one gateway hour that includes ten tunnels, with data at $0.087 per GB after 100 GB free.
The line is drawn in a different place. AWS meters each connection; Azure meters the gateway. With one branch you are comparing AWS's two hourly meters ($72 over 30 days) with Azure's one ($153.30 over 730 hours). With ten branches AWS multiplies by ten and Azure fits all ten inside the same gateway. User VPN follows the same pattern: AWS Client VPN charges $0.05 an hour per connection, Azure includes 128 in the gateway hour. The difference is what the hourly meter is attached to, not the size of the number.
In both cases, a bill divided by headcount is your figure, not a per-user price the vendor publishes (article-07).
Who this is not for
If you have no virtual network in Azure and want a business VPN sold by the seat, none of this applies. A VPN gateway connects things to Azure's side; it is not a stand-in for a SaaS VPN. For prices that are published per user, the calculator with your headcount typed in is the faster route.
Sources
- https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ — checked 2026-10-02 (730-hour note, included tunnel and connection counts; price cells unreadable server-side, shown as "$-")
- https://prices.azure.com/api/retail/prices?currencyCode='USD'&$filter=serviceName eq 'VPN Gateway' and armRegionName eq 'eastus' — checked 2026-10-02 (hourly rates for SKUs, S2S and P2S)
- https://prices.azure.com/api/retail/prices?currencyCode='USD'&$filter=serviceName eq 'Bandwidth' and armRegionName eq 'eastus' and contains(meterName,'Data Transfer Out') — checked 2026-10-02 (data transfer tiers)
- https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways — checked 2026-10-02 (SKU limits, the two billed items, migration note)
- https://seatbill.com/vpn-pricing/article-17 — the AWS examples
Related on this site
- What does AWS actually charge for a VPN?
- Google Cloud VPN pricing: tunnel hours and egress
- What a business VPN price leaves out
- Per user, per device, or per server — the unit is not the same everywhere
- What is a VPN tunnel, and does all of your traffic have to go through it?
- Business VPN cost per user calculator
Written by Kaz (pen name). Published October 2, 2026. Prices were checked on the dates given under Sources. We have not used these products. Corrections: contact form.