Azure Bastion cost: a fixed hourly fee for secure VM access

Quick answer

Azure Bastion charges a fixed hourly fee by tier, starting around $0.19/hour for Basic (roughly $140/month), plus outbound data transfer and per-scale-unit charges on higher tiers. It runs continuously whether or not anyone connects, so it pays off as shared secure access to many VMs, not for one VM you rarely touch.

Azure Bastion gives secure RDP and SSH access to virtual machines through the portal without exposing public IPs. It is a managed service billed by the hour, and like most fixed-fee services the question is whether enough usage justifies the always-on cost.

A fixed hourly fee

Basic Bastion is about $0.19 per hour, roughly $140 a month, and it runs continuously once deployed. Standard and higher tiers add features and scale units at a higher hourly rate. Because the fee is fixed, an idle Bastion costs the same as a busy one.

Shared access changes the math

One Bastion serves every VM in its virtual network, so the more machines and people that use it, the better the fixed fee amortizes. For a team securely accessing a fleet of VMs, $140 a month is cheap insurance against exposed management ports. For a single VM an engineer touches once a month, it is poor value.

Alternatives for occasional access

For rare access, a just-in-time VM access policy, a temporary public IP behind a tight NSG, or SSH through a small self-managed jump box can be far cheaper than an always-on Bastion. The tradeoff is convenience and security posture, so weigh how often you actually connect against the monthly fee.

FAQ

How much does Azure Bastion cost?

A fixed hourly fee by tier, starting around $0.19 per hour for Basic (roughly $140 per month), plus outbound data transfer and per-scale-unit charges on higher tiers. It runs continuously regardless of whether anyone connects.

Does Azure Bastion charge when idle?

Yes. The hourly fee is fixed, so an idle Bastion costs the same as a busy one, roughly $140 a month for Basic. This is why it suits shared access to many VMs rather than a single rarely-used machine.

How do I reduce Azure Bastion cost?

Deploy one Bastion per virtual network to serve all its VMs so the fixed fee amortizes across many machines and users. For occasional access, consider just-in-time VM access, a temporary public IP behind a tight NSG, or a small jump box instead.

Is Azure Bastion worth it for one VM?

Usually not. At about $140 a month for Basic, an always-on Bastion for a single rarely-accessed VM is poor value. It pays off when many VMs and users share it, or when avoiding exposed management ports is a firm requirement.

What is the difference between Bastion tiers?

Basic provides core secure access at the lowest hourly fee. Standard and higher tiers add features like native client support, IP-based connection, and configurable scale units, at a higher hourly rate. Choose the lowest tier that meets your access needs.

Does C3X estimate Azure Bastion cost?

C3X prices the azurerm_bastion_host resource from your Terraform, including the fixed hourly fee, so the always-on cost appears before deploy. Data transfer depends on usage, which you provide as an assumption.

What to do next

See the always-on cost before you deploy. C3X reads your Terraform and prices Azure Bastion and the rest of your stack against a live catalog. Start with the quickstart.