azurerm_point_to_site_vpn_gateway cost estimation

An azurerm_point_to_site_vpn_gateway is the user-VPN gateway inside an Azure Virtual WAN hub — it lets individual clients (laptops, remote workers) connect into the network, as opposed to the site-to-site azurerm_vpn_gateway which connects whole networks. Cost is per scale unit (~$0.361/scale-unit-hour, so ~$264/month for one), plus a small per-connected-user charge and hub data processing.

Each scale unit provides aggregate P2S connection capacity and throughput; you provision scale units to your expected concurrent user count and bandwidth. The scale-unit fee is the standing cost, billed continuously, while the per-user charge scales with how many clients actually connect.

The cost decisions are scale-unit count (size to peak concurrent users, not total enrolled users) and whether you need Virtual WAN at all — for a small remote-access setup into a single VNet, the classic Virtual Network Gateway's point-to-site capability may be simpler and cheaper than standing up a Virtual WAN hub.

c3x prices the gateway from its scale_unit count, so the standing cost is visible before deployment.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_point_to_site_vpn_gateway" "users" {
  name                        = "p2s-gateway"
  location                    = azurerm_resource_group.main.location
  resource_group_name         = azurerm_resource_group.main.name
  virtual_hub_id              = azurerm_virtual_hub.main.id
  vpn_server_configuration_id = azurerm_vpn_server_configuration.main.id
  scale_unit                  = 1

  connection_configuration {
    name = "remote-users"
    vpn_client_address_pool {
      address_prefixes = ["10.0.0.0/24"]
    }
  }
}

Pricing dimensions

What you actually pay for when you provision azurerm_point_to_site_vpn_gateway.

Dimension	Unit	What's being charged
P2S scale units	per scale-unit-hour	Each scale unit provides P2S connection capacity/throughput, billed continuously. Provision to peak concurrent users. $0.361/scale-unit-hour → 1 unit ≈ $263.53/month
Connected users	per user-hour	A small per-connected-user charge on top of scale units. Usage-based.

Sample C3X output

A single P2S scale unit in a Virtual WAN hub, 24/7:

azurerm_point_to_site_vpn_gateway.users
└─ P2S scale units (1)   730 unit-hours   $263.53
                         Monthly          $263.53

Optimization tips

Common ways to reduce azurerm_point_to_site_vpn_gateway cost without changing the workload.

Size scale units to peak concurrent users

~$264/month per scale unit avoided

Each scale unit is ~$264/month of capacity. Provision to peak simultaneous connections and throughput — not total enrolled users, most of whom aren't connected at once.

Use the classic gateway for small single-VNet remote access

Avoids Virtual WAN hub overhead

Virtual WAN is for hub-and-spoke at scale. For simple remote access into one VNet, the classic azurerm_virtual_network_gateway's point-to-site capability may be simpler and cheaper than a Virtual WAN hub plus P2S gateway.

Mind hub data processing

Per-GB processing on misrouted traffic

Beyond scale units, Virtual WAN bills data processed through the hub. Route only necessary traffic through it to control the per-GB charge.

FAQ

How is an Azure Point-to-Site VPN gateway billed?

By scale unit — ~$0.361/scale-unit-hour, so ~$264/month for one — each providing P2S connection capacity and throughput, plus a small per-connected-user charge and Virtual WAN hub data processing.

How is this different from azurerm_vpn_gateway?

Point-to-site connects individual user clients (laptops, remote workers) into the network; site-to-site (azurerm_vpn_gateway) connects whole networks. Both live in a Virtual WAN hub and bill by scale unit.

How does c3x estimate the cost?

From the scale_unit count, pricing the standing scale-unit-hour fee. Per-user charges and hub data processing are usage-driven and modelled separately.

Related resources

Azure

azurerm_vpn_gateway

The site-to-site VPN gateway counterpart in the same Virtual WAN hub

`azurerm_point_to_site_vpn_gateway` cost estimation