Azure Private Link cost: per endpoint hour plus data processed

Quick answer

Private Link bills per private endpoint per hour plus per GB of data processed through it, giving private connectivity to Azure services (and your own) over the Microsoft backbone. It adds a per-endpoint cost but keeps traffic off the public internet and can reduce egress. Where you only need to keep traffic on the Azure network without a private IP, free service endpoints are the cheaper alternative.

Azure Private Link provides private connectivity to Azure PaaS services (and your own services behind a Private Link Service) using a private endpoint in your virtual network. It has a per-endpoint hourly fee plus a data-processing charge, so its cost scales with how many endpoints you run and how much traffic flows through them.

Per endpoint plus data processed

Dimension	Bills for
Private endpoint	Per endpoint per hour
Data processed	Per GB inbound and outbound through the endpoint

Each private endpoint carries an hourly fee whether or not traffic flows, plus a per-gigabyte charge on the data processed through it (both directions). So many endpoints across many services, or high traffic volumes, drive the cost.

Private Link vs service endpoints

Azure offers two ways to keep traffic to PaaS services off the public internet. Service endpoints are free and route traffic to a service over the Azure backbone, but the service keeps a public identity. Private Link gives the service a private IP in your VNet (no public exposure) at the per-endpoint and per-GB cost. If you only need traffic on the backbone, service endpoints suffice for free; use Private Link when you need the private IP and full network isolation, the same free-versus-paid tradeoff as AWS gateway versus interface endpoints.

Controlling Private Link cost

Use free service endpoints where you only need backbone routing, reserve Private Link for services that genuinely need a private IP and isolation, consolidate endpoints where possible, and be mindful of the data-processing charge on high-traffic paths. Because it can also remove traffic from public egress, weigh the endpoint cost against the egress and security benefit for each use.

FAQ

How is Azure Private Link priced?

Per private endpoint per hour (whether or not traffic flows) plus per gigabyte of data processed through the endpoint in both directions. Cost scales with how many endpoints you run and the traffic volume through them, so many endpoints or high-traffic paths drive the bill.

Private Link or service endpoints for cost?

Service endpoints are free and route traffic to Azure services over the backbone, but the service keeps a public identity. Private Link gives the service a private IP in your VNet at a per-endpoint and per-GB cost. Use free service endpoints where you only need backbone routing; use Private Link when you need the private IP and full isolation.

How do I reduce Azure Private Link cost?

Use free service endpoints where you only need traffic on the Azure backbone, reserve Private Link for services that genuinely need a private IP and network isolation, consolidate endpoints where possible, and be mindful of the per-GB data-processing charge on high-traffic paths.

Does Private Link charge when idle?

The per-endpoint hourly fee applies whether or not traffic flows, so an idle private endpoint still costs its hourly rate. The data-processing charge scales with actual traffic. So each endpoint has a standing cost plus a variable data cost, making endpoint count a factor even at low traffic.

Does Private Link reduce egress cost?

It can, by keeping traffic to Azure services on the Microsoft backbone rather than traversing public egress, similar to how VPC endpoints reduce NAT traffic on AWS. Weigh the per-endpoint and per-GB Private Link cost against the egress and security benefit for each service to decide if it nets out cheaper.

Does C3X estimate Private Link cost?

C3X prices the azurerm_private_endpoint resource from your Terraform, including the hourly fee, so the fixed per-endpoint cost appears before deploy. Data processed depends on traffic, which you provide as a usage assumption.

What to do next

Compare private connectivity options before you build. C3X reads your Terraform and prices Private Link and the rest of your stack against a live catalog. Start with the quickstart.