13 Nov 2026
Bandwidth egress.
Every Azure invoice review has the same moment. Compute is explained, storage is explained, and then someone points at the data transfer line and asks what it is.
Nobody knows, because nobody bought it. Egress isn't a resource you deploy. It's a side effect of where you put things, and it shows up a month after the decision that caused it.
The rule underneath is short: data going into Azure is free, data coming out of a region is billed. Microsoft's own wording is that data transfer between Azure services located in two regions is charged as outbound data transfer at the normal rate, and inbound data transfer is free. The hard part is the exceptions, and knowing which arrow in your architecture is which.
01Where a byte gets billed
Same-region traffic between services is the cheap case: there's no data transfer cost between Azure services deployed in the same region. Peering is the exception that catches people. A peered VNet in the same region is still priced per GB, inbound and outbound, so the same gigabyte is billed once leaving one VNet and once entering the other.
The $1,375 comes from Microsoft's multi-region storage estimate, at sample prices: 50,000 GB uploaded to a GRS account costs $1,000 just to replicate to the secondary region, and $375 more because 75% of the clients downloading the files sit in another region. That's 83% of the scenario's $1,648.80 total, and none of it is storage. The 100 GB is the free monthly outbound allowance listed for public IP egress. Past it, every gigabyte counts.
02The six-step egress playbook
Run these in order. Each one ends with something you can check, so the next person reviewing the invoice gets an answer instead of a shrug.
In Cost analysis, take the last three months and group by Meter, then by Location. Data transfer meters separate from compute and storage, and the location says which region's resources carry them. Done when you have one monthly figure per region and know whether it's flat or growing.
Three buckets: inter-region (another Azure region), leaving Azure (internet, on-premises, another cloud) and peering (VNet to VNet, billed at both ends, and at a zone-based rate when it's global). They have different fixes, so never optimise the total. Done when each meter from step 1 sits in one bucket.
For storage, the Activity report in Azure Storage Discovery ranks the top 10 accounts by billable egress and splits each one into Inter-region (by geography) and Leaving Azure. It needs the Standard plan; the Free plan has no Activity insights. For VNet traffic, Microsoft points to Azure Monitor and Network Watcher to find the expensive cross-region and cross-VNet flows. Done when the biggest sources have a name and an owner.
An app in one region reading a database or storage account in another pays for every response. Microsoft's guidance is to colocate communicating workloads and prefer regional peering over global. Ask the same question of every GRS account: does this data need a second region, or did it get GRS because it was the default? One thing you can skip: sending diagnostic settings to another region incurs no data transfer charge. Done when every remaining cross-region flow has a reason, like disaster recovery, written down.
A CDN doesn't make egress free. With Azure Front Door, data from an Azure origin to Front Door isn't billed, even when the origin is in another region. What you pay is edge to client, plus a base fee and a per-request fee. The savings come from two places: a cache hit never goes back to the origin, and with compression on, only the compressed bytes are billed. Static files, downloads and images win. Uncacheable API responses mostly just move to a different meter. Done when you've checked the cache hit rate and compression on the routes that carry the most bytes.
Organisations billed in the EEA, EFTA or the UK that move data over the internet to another provider they also use can get it at cost. You file a support request with the subscription ID, the external endpoint's ASN and an estimate of the share of traffic. The traffic has to go over the ISP routing preference, the data must be processed by the same organisation, and CDN delivery doesn't count. Bought through a CSP? The partner files it. Done when the request is in and the refund shows up on the next bill.
03What the line item is really telling you
That's why it's the line nobody can explain. The fix is rarely a setting. It's reading the transfer charge as a map of which components talk across a boundary, and then deciding which of those conversations are worth paying for. Before the next region or peering goes in, the Bandwidth widget in the Azure pricing calculator takes a transfer type, a source region, a destination region and a GB estimate. That's five minutes, and it's cheaper than finding out on the invoice.
- Azure Monitor cost and usage — inter-region transfer billed as outbound, inbound free, diagnostic settings across regions not charged.
- Azure Virtual Network cost optimization principles — peering priced per GB inbound and outbound, global peering zone-based, colocation guidance.
- Understanding Azure Front Door billing — origin to Front Door not billed, cache hits skip the origin meter, compressed bytes only.
- Cost estimate: upload and access data from multiple regions — the GRS sample: $1,000 to replicate, $375 in cross-region reads.
- Egress insights in Azure Storage Discovery — top 10 accounts by billable egress, inter-region vs leaving Azure, Standard plan only.
- Data transfer fees to an external endpoint — at-cost transfer for EEA, EFTA and UK billing addresses, and its conditions.
Cost analysis answers this one subscription at a time. GraphPaaS reads Azure spend for every tenant you manage and breaks it down by service, region, resource group, resource type and resource, with a month-by-month drill-down. A transfer charge that grows in one region next to a storage account that grows with it is the same trend twice. It's the same exercise as storage tiering: the bill tells you where to look, and the architecture tells you why.
Find what's behind the transfer line.
Which region and which service, in every tenant you manage.
Break down your Azure billOr ask Claude: "Which regions drove our Azure spend this month?"