Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure Application Gateway v2 bills fixed cost + Capacity Units (CU): Basic v2 $0.0225/hour ($16.43/month) + $0.008/CU-hour ($5.84/CU-month), Standard v2 $0.20/hour ($146.00/month) + $0.008/CU, and WAF v2 $0.36/hour ($262.80/month) + $0.0144/CU ($10.51/CU-month). At 10 CU: Basic $74.83/month, Standard $204.40, WAF $367.92; at 50 CU: $308.43 / $438.00 / $788.40; at 100 CU: $600.43 / $730.00 / $1,314.00. The fixed fee applies even at zero traffic ($16.43/$146.00/$262.80). One CU = 2,500 persistent connections + 1 GB/hour (2.22 Mbps) throughput + one compute unit; one instance reserves 10 CU, and autoscale min 0 saves CU but not the fixed fee. WAF v2 includes WAF policies/rules at no per-rule or per-request charge; public IP, outbound data transfer and logs are extra. The v1 SKU retired on 28 April 2026, and Basic v2 is still preview.
This guide is for architects, cloud platform/SRE, security and procurement teams designing a single-region L7 entry, WAF, AKS ingress or replacing a v1 gateway. It explains Basic v2/Standard v2/WAF v2 fixed costs and CU, the four CU dimensions, 10/50/100 CU TCO, autoscale billing, Application Gateway for Containers (AGC), the Front Door/Load Balancer boundary and a 90-day optimization checklist. Prices come from the Azure Application Gateway pricing page, the Azure Retail Prices API and Microsoft Learn (eastus, 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Total = fixed fee + CU; the fixed fee is hourly and applies even at zero traffic, and Basic v2's fixed fee is about 1/9 of Standard's. (2) One instance reserves 10 CU; autoscale min 0 saves CU but not the fixed fee, and the bill takes the higher of utilization or instance count. (3) WAF v2 is $0.36 fixed + $0.0144/CU with WAF rules included; public IP, egress and logs are extra, and v1 retired on 28 April 2026.
v2 SKUs: fixed fee and CU price
The v2 fixed fee depends only on the SKU and deployment hours, not on the number of instances; it applies even when autoscale minimum is 0. Basic v2 is preview, has the lowest fixed fee, auto-scales to about 200 connections/second, and cannot configure autoscale instance counts like Standard/WAF; Standard v2 supports autoscale, zone redundancy and private link; WAF v2 adds WAF on top of Standard, with a higher fixed fee and CU price, but WAF policies/rules are included.
| SKU | Fixed/hour | Fixed/month | CU/hour | CU/month | Note |
|---|---|---|---|---|---|
| Basic v2 | 0.0225 | 16.43 | 0.008 | 5.84 | Preview; auto to ~200 conn/s |
| Standard v2 | 0.20 | 146.00 | 0.008 | 5.84 | Autoscale, zone redundancy |
| WAF v2 | 0.36 | 262.80 | 0.0144 | 10.51 | WAF policies/rules included |
| AGC | 0.017 | 12.41 | 0.008 | 5.84 | + frontend 0.01/h, association 0.12/h |
| AGC WAF | 0.031 | 22.63 | 0.014 | 10.22 | + frontend 0.018/h, association 0.216/h |
| v1 Small (retired) | 0.025 | 18.25 | — | — | Data processed 0.008/GB |
| v1 Medium (retired) | 0.07 | 51.10 | — | — | Data processed 0.007/GB |
| v1 Large (retired) | 0.32 | 233.60 | — | — | Data processed 0.0035/GB |
Sources: Azure Application Gateway pricing page and Azure Retail Prices API (eastus, 9 November 2026). Monthly = hourly × 730; fixed fee excludes public IP; outbound data uses standard data-transfer rates; v1 retired on 28 April 2026, Basic v2 is preview.
Capacity Unit: four dimensions and per-CU capability
A CU is the capacity unit, made of 2,500 persistent connections, 1 GB/hour (2.22 Mbps) throughput and one compute unit, plus actual request processing. The bill takes the higher of utilization-based CU and instance-reserved CU: one instance is about 10 reserved CU; autoscale min 0 has no reservation and bills only actual usage. Compute-unit capacity varies with TLS key size, key exchange, header rewrites and WAF request size; Microsoft's rough guidance is Standard_v2 about 50 connections/s/CU, WAF_v2 about 10 concurrent requests/s/CU and Basic_v2 about 10 connections/s/CU.
| Dimension/guidance | 1 CU or per instance | Note |
|---|---|---|
| Persistent connections | 2,500 | Check first for long-lived/keep-alive traffic |
| Throughput | 1 GB/hour (2.22 Mbps) | Hourly basis |
| Compute unit | 1 | TLS/rewrite/WAF consumption |
| Standard_v2 | ~50 connections/s/CU | RSA 2048 TLS certificate |
| WAF_v2 | ~10 concurrent requests/s/CU | 70% requests under 2 KB |
| Basic_v2 | ~10 connections/s/CU | Preview |
| 1 instance | ~10 CU reserved | Min instance=1 bills at least 10 CU |
Sources: Learn "Understanding pricing" and "Scaling Application Gateway v2" (9 November 2026). Compute-unit guidance is approximate; calibrate with gateway metrics and load testing.
10 / 50 / 100 CU TCO: Basic vs Standard vs WAF
Fixed fee + CU×730: 10 CU: Basic $74.83, Standard $204.40, WAF $367.92; 50 CU: $308.43 / $438.00 / $788.40; 100 CU: $600.43 / $730.00 / $1,314.00. Basic v2's fixed-fee advantage is largest at low traffic; Standard's fixed fee is 8.9× Basic but the CU price is the same; WAF's CU price and fixed fee are 1.8× Standard. As traffic grows, CU dominates and the fixed-fee difference dilutes.
| CU | Basic v2/month | Standard v2/month | WAF v2/month |
|---|---|---|---|
| 10 CU | 74.83 | 204.40 | 367.92 |
| 50 CU | 308.43 | 438.00 | 788.40 |
| 100 CU | 600.43 | 730.00 | 1,314.00 |
Editorial calculation: fixed fee + CU×monthly CU price; excludes public IP, egress, logs, Key Vault, DDoS, tax and discounts. CU counts are editorial assumptions; actual billing takes the highest of connection/throughput/compute.
Autoscale: min 0, min 1 and instance reservation
The autoscale minimum instance count sets reserved CU: min=0 has no reservation and bills actual usage; min=1 bills at least 10 CU even if average usage is 5 CU. Examples: Standard min=0, average 10 CU = $204.40; min=1, average 5 CU still bills 10 CU = $204.40; min=1, average 30 CU = $321.20; WAF min=1, average 30 CU = $578.16. The fixed fee always applies, so scaling to 0 saves CU but not the fixed fee; min=0 suits intermittent/low traffic, while production must weigh cold start and latency.
| Scenario | Fixed fee | Billed CU | CU cost | Total/month |
|---|---|---|---|---|
| Standard min=0, avg 10 CU | 146.00 | 10 | 58.40 | 204.40 |
| Standard min=1, avg 5 CU | 146.00 | 10 | 58.40 | 204.40 |
| Standard min=1, avg 30 CU | 146.00 | 30 | 175.20 | 321.20 |
| WAF min=0, avg 10 CU | 262.80 | 10 | 105.12 | 367.92 |
| WAF min=1, avg 30 CU | 262.80 | 30 | 315.36 | 578.16 |
| Basic v2, 10 CU | 16.43 | 10 | 58.40 | 74.83 |
Editorial calculation: 730 hours/month; billed CU = max(utilization CU, instances×10); min=0 has no reservation; fixed fee does not vary with instance count. Excludes public IP/egress/logs/tax/discounts.
Application Gateway for Containers (AGC)
AGC is a managed L7 ingress for Kubernetes/AKS, billed by resource + Frontend + Association + CU: AGC resource $0.017/hour ($12.41/month), Frontend $0.01/hour ($7.30), Association $0.12/hour ($87.60), CU $0.008/hour ($5.84/CU). One AGC + one Frontend + one Association + 10 CU = $165.71/month; the WAF version is $0.031/$0.018/$0.216/$0.014, so the same 10 CU = $295.65/month. Association is per Gateway/association, so multiple Frontends/Associations stack.
| Component | Price/hour | Monthly | Note |
|---|---|---|---|
| AGC resource | 0.017 | 12.41 | Per AGC resource |
| Frontend | 0.01 | 7.30 | Per Frontend |
| Association | 0.12 | 87.60 | Per Association |
| AGC CU | 0.008 | 5.84/CU | Capacity unit |
| AGC 10 CU total | — | 165.71 | 1+1+1+10 CU |
| AGC WAF resource | 0.031 | 22.63 | WAF version |
| AGC WAF Frontend/Association | 0.018 / 0.216 | 13.14 / 157.68 | WAF version |
| AGC WAF CU | 0.014 | 10.22/CU | WAF version |
| AGC WAF 10 CU total | — | 295.65 | 1+1+1+10 CU |
Sources: Azure Application Gateway pricing page and Azure Retail Prices API (eastus, 9 November 2026). AGC is for Kubernetes/AKS; Association is per association, so component counts follow the deployment topology.
App Gateway vs Front Door vs Load Balancer vs AGC
Choose by traffic shape: single-region L7, TLS termination, WAF, path/host routing use Application Gateway (Standard/WAF v2); multi-region, global acceleration, CDN, edge WAF use Front Door; L4 TCP/UDP, very high throughput, non-HTTP use Load Balancer; AKS ingress use AGC. App Gateway WAF v2 includes WAF rules in the fixed fee with no per-rule/per-request charge; Front Door's WAF pricing is different, so comparing only the "WAF monthly fee" is misleading.
| Scenario | Prefer | Why/check first |
|---|---|---|
| Single-region L7/SSL/path routing | Standard v2 | Autoscale, zone redundancy |
| Single region + WAF | WAF v2 | WAF rules included, no per-request charge |
| Multi-region/global acceleration/CDN | Front Door | Global entry, edge WAF |
| L4 TCP/UDP/non-HTTP | Load Balancer | Layer-4 forwarding |
| AKS ingress | AGC | Kubernetes Gateway/Ingress |
| Dev/test low cost | Basic v2 (preview) | No WAF/fine autoscale |
| WAF without per-rule/request billing | WAF v2 | WAF policies/rules included |
| Still on v1 | Migrate to v2 | v1 retired 28 April 2026 |
Editorial selection framework, not a vendor recommendation; Front Door/Load Balancer costs are on their own pricing pages. Sources: Learn docs and pricing page (9 November 2026).
Hidden costs and the v1 retirement
Seven items sit outside fixed fee + CU: public IP (not included), outbound data transfer (standard rates), logs/metrics (Log Analytics ingestion), Key Vault/certificates, optional DDoS/Network Watcher, autoscale reservation (min=1 bills at least 10 CU), and AGC Frontend/Association. In addition, v1 SKUs retired on 28 April 2026; any remaining gateway should migrate to v2. The v1 "Small/Medium/Large + per-GB data processing" model is no longer the main path.
| Cost item | Trigger | Control |
|---|---|---|
| Public IP | Not in fixed fee | Public IP pricing separately |
| Outbound data | Standard data transfer | Nearby backends/compression |
| Logs/metrics | Log Analytics | Sampling/retention |
| Certificates/Key Vault | TLS certificate management | Central management/rotation |
| Autoscale reservation | min=1 bills at least 10 CU | Set min=0 for low traffic |
| AGC Frontend/Association | Multiple frontends/associations | Merge by topology |
| v1 retirement | 28 April 2026 | Migrate to v2 |
| WAF rules | Included in WAF v2 | No per-rule purchase |
Sources: Azure Application Gateway pricing page, Learn "Understanding pricing" and v2 overview (9 November 2026). Public IP/egress/log prices follow their own product pages.
90-day optimization checklist
Use 90 days to move through "inventory → tier → CU → autoscale → WAF → review". Weeks 1–2: count listeners/rules/WAF, peak connections/throughput/requests, TLS handshakes and header rewrites. Weeks 2–4: confirm single-region L7 uses App Gateway, global entry uses Front Door, L4 uses Load Balancer, AKS uses AGC. Weeks 4–6: calculate CU from metrics and compare 1/5/10-instance reservations. Weeks 6–8: set non-production min to 0, production min to cover cold start, and cap max to prevent runaway. Weeks 8–10: verify WAF v2 includes rules and check public IP/egress/log bills. Weeks 10–12: complete v1→v2 migration and load testing.
FAQ
How is Application Gateway billed?
v2 bills fixed fee + Capacity Units: Basic v2 $0.0225/hour + $0.008/CU, Standard v2 $0.20/hour + $0.008/CU, WAF v2 $0.36/hour + $0.0144/CU; the fixed fee is independent of instance count, and CU takes the higher of utilization or instance reservation. Public IP, egress and logs are extra.
How much more is Standard v2 than Basic v2?
Fixed fee: Basic $16.43/month, Standard $146.00/month, about 8.9×; the CU price is the same $5.84/CU-month. At 10 CU, Basic is $74.83 and Standard $204.40. Basic v2 is preview, auto-scales to about 200 connections/second, cannot configure autoscale instances like Standard, and has no WAF.
How much more is WAF v2? Are WAF rules extra?
WAF v2 is $262.80/month fixed and $10.51/CU-month; at 10 CU it is $367.92, $163.52 more than Standard's $204.40. WAF policies/rules are included in WAF v2 with no per-rule or per-request charge; public IP, egress and logs are still extra.
What is one CU?
One CU = 2,500 persistent connections + 1 GB/hour (2.22 Mbps) throughput + one compute unit, taking the highest actual request processing. Rough guidance: Standard_v2 about 50 connections/s/CU, WAF_v2 about 10 concurrent requests/s/CU, Basic_v2 about 10 connections/s/CU.
How does autoscale affect the bill?
One instance reserves about 10 CU; min=0 has no reservation and bills actual usage; min=1 bills at least 10 CU. The fixed fee always applies, so scaling to 0 saves CU but not the fixed fee. Example: Standard min=0/average 10 CU = $204.40; min=1/average 5 CU still $204.40; min=1/average 30 CU = $321.20.
Can Basic v2 be used in production?
Basic v2 is still preview and suits dev/test, low traffic or cost-sensitive single-region entry; it auto-scales to about 200 connections/second, cannot fine-tune autoscale and has no WAF. Production WAF/zone redundancy/higher elasticity should use Standard v2 or WAF v2.
How is AGC billed, and how does it compare with App Gateway?
AGC bills resource $12.41/month + Frontend $7.30 + Association $87.60 + CU $5.84/CU; 1+1+1+10 CU = $165.71, or $295.65 for the WAF version. AGC is for Kubernetes/AKS Ingress/Gateway API; traditional VM/VMSS single-region L7 uses App Gateway.
Can v1 still be used?
Not for new deployments. v1 SKUs (Standard/WAF) retired on 28 April 2026 and are no longer supported; remaining gateways should migrate to v2. The v1 Small/Medium/Large + per-GB data processing model is no longer the main path.
Research method and limitations
This article separates "official price facts" from "editorial calculations": Basic v2 $0.0225/$0.008, Standard v2 $0.20/$0.008, WAF v2 $0.36/$0.0144, AGC $0.017/$0.01/$0.12/$0.008, AGC WAF $0.031/$0.018/$0.216/$0.014 and v1 $0.025/$0.07/$0.32 with data processing $0.008/$0.007/$0.0035 come from the Azure Retail Prices API (eastus, 9 November 2026); fixed+CU billing, the four CU dimensions, 10 CU per instance, autoscale 0–100/0–125, WAF rules included, public IP excluded, v1 retirement on 28 April 2026 and Basic v2 preview come from the Azure Application Gateway pricing page and Microsoft Learn (understanding pricing, autoscaling, overview, AGC).
Eight limitations: (1) only eastus list prices, excluding tax/CSP/enterprise discounts; (2) 730-hour months; (3) the main TCO excludes public IP, egress, logs, Key Vault, DDoS and tax; (4) CU counts are editorial assumptions; actual billing takes the highest of connection/throughput/compute and needs metric/load-test calibration; (5) Basic v2 is preview and its price/features may change; (6) AGC Frontend/Association counts follow topology, and the example uses 1+1; (7) Front Door/Load Balancer full TCO is not covered; (8) prices/features change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Application Gateway Pricing: azure.microsoft.com/en-us/pricing/details/application-gateway. Basic v2/Standard v2/WAF v2, AGC, v1, fixed fee/CU. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains Application Gateway, eastus): prices.azure.com/api/retail/prices. $0.0225/$0.20/$0.36, $0.008/$0.0144, AGC $0.017/$0.01/$0.12/$0.008, AGC WAF $0.031/$0.018/$0.216/$0.014, v1 $0.025/$0.07/$0.32. Accessed 9 November 2026.
- Microsoft Learn, Understanding pricing: learn.microsoft.com/en-us/azure/application-gateway/understanding-pricing. Fixed+CU, four CU dimensions, 10 CU per instance, compute-unit guidance. Accessed 9 November 2026.
- Microsoft Learn, Scaling Application Gateway v2: learn.microsoft.com/en-us/azure/application-gateway/application-gateway-autoscaling-zone-redundant. Autoscale min/max instances, 10 CU per instance, Basic auto-scale. Accessed 9 November 2026.
- Microsoft Learn, Application Gateway overview / for Containers: learn.microsoft.com/en-us/azure/application-gateway/overview, for-containers/overview. v1 retirement on 28 April 2026, v2 capabilities, AGC components. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.