Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure Bastion's four SKUs differ materially in monthly cost: Developer is free (shared resource, one VM at a time, select regions); Basic $0.19/hour (about $138.70/month) with 2 fixed instances; Standard $0.29/hour (about $211.70/month, 2 instances included), scalable to 50 instances with additional instances at $0.14/hour; Premium $0.45/hour (about $328.50/month, 2 instances included), with additional instances at $0.22/hour, including session recording and private-only deployment. Outbound data transfer is free for the first 5GB/month, then billed at Azure data-transfer rates (this article uses $0.05/GB for scenarios). At 100GB/month outbound: Developer 0, Basic about $143.45, Standard about $216.45, Premium about $333.25; adding one instance to Standard/Premium gives about $318.65/$493.85. Selection rule: Developer for dev/test; Basic for small production; Standard for native client/custom ports/IP connect/shareable links/file transfer/scaling; Premium for session recording/audit/private-only.
This guide is for Azure networking, security, SRE and procurement teams. It explains Bastion SKU features/concurrency/scaling, hourly fees and outbound transfer, 100GB/1TB TCO, additional-instance/public-IP/recording costs, and the boundary versus VPN/private access. Prices come from the Azure Bastion pricing page and Azure Retail Prices API (eastus, 9 November 2026); features/limits come from Microsoft Learn's Bastion SKU comparison and overview. Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Check the SKU capability gap first: Basic has 2 fixed instances/no native client; Standard scales to 50 instances and supports custom ports/IP connect/file transfer; Premium adds session recording and private-only. (2) Monthly cost = hourly fee × 730 + outbound transfer (first 5GB free); Standard/Premium include 2 instances, and scaling adds per-instance fees. (3) Bastion is not a VPN: it is a managed jump host/operations entry, not site-to-site or full-tunnel remote access; choose by “ops sessions + audit + no public IP.”
Four SKUs: Developer / Basic / Standard / Premium
Developer is free with shared infrastructure, one VM at a time and select regions, suitable for dev/test. Basic is a dedicated deployment with 2 fixed instances, up to 40 RDP/80 SSH sessions, requires a public IP and lacks native client/custom ports/IP connect/shareable links/file transfer. Standard adds 2–50 instance scaling, native client (Azure CLI), custom inbound ports, IP connect, shareable links and file upload/download, up to 1,000 RDP/2,000 SSH at 50 instances. Premium includes all Standard features plus session recording and private-only (no public IP) deployment.
| Capability | Developer | Basic | Standard | Premium |
|---|---|---|---|---|
| Deployment | Shared resource | Dedicated; public IP required | Dedicated; public IP required | Dedicated; private-only option |
| Instances/scaling | 1 VM at a time | 2 fixed instances | 2–50 instances | 2–50 instances |
| Max sessions | 1 VM at a time | 40 RDP/80 SSH | 1,000 RDP/2,000 SSH | 1,000 RDP/2,000 SSH |
| Native client/custom ports | No | No | Yes | Yes |
| IP connect/shareable links/file transfer | No | No | Yes | Yes |
| Session recording/private-only | No | No | No | Yes |
Source: Microsoft Learn, Choose the right Azure Bastion SKU / Bastion overview (9 November 2026). Editorial summary; regional/feature availability follows official docs.
Unit prices: hourly, additional instances and outbound
Eastus list prices: Developer 0; Basic $0.19/hour; Standard $0.29/hour (2 instances included); Premium $0.45/hour (2 instances included); additional Standard instance $0.14/hour; additional Premium instance $0.22/hour. Outbound transfer is free for the first 5GB/month, then Azure data-transfer rates; the API shows $0.05–$0.087/GB tiers (by zone/direction), and this article uses $0.05/GB for scenarios—verify on the pricing page/bill.
| Item | Price (USD) | Note |
|---|---|---|
| Developer | 0/hour | Shared resource; outbound free |
| Basic | 0.19/hour | About 138.70/month; 2 fixed instances |
| Standard | 0.29/hour | About 211.70/month; 2 instances included |
| Premium | 0.45/hour | About 328.50/month; 2 instances included |
| Additional Standard instance | 0.14/hour | About 102.20/month/instance |
| Additional Premium instance | 0.22/hour | About 160.60/month/instance |
| Outbound transfer | 0.05–0.087/GB (example 0.05) | First 5GB/month free |
Sources: Azure Retail Prices API (eastus, 9 November 2026) and Azure Bastion pricing page. Monthly prices use 730 hours; outbound rates vary by zone/direction—pricing page/bill is authoritative.
TCO: 100GB/month and 1TB/month outbound
At 730 hours/month, first 5GB free and $0.05/GB: 100GB/month outbound (95GB billed = $4.75): Developer 0; Basic $138.70+$4.75=$143.45; Standard $211.70+$4.75=$216.45; Standard+1 instance $313.90+$4.75=$318.65; Premium $328.50+$4.75=$333.25; Premium+1 instance $489.10+$4.75=$493.85. 1TB/month outbound (1,019GB = $50.95): Basic $189.65, Standard $262.65, Premium $379.45. Excludes public IP, VNet peering, recording storage, tax/discounts.
| Option | 100GB/month | 1TB/month |
|---|---|---|
| Developer | 0 | 0 |
| Basic | 143.45 | 189.65 |
| Standard (2 instances) | 216.45 | 262.65 |
| Standard +1 instance | 318.65 | 364.85 |
| Premium (2 instances) | 333.25 | 379.45 |
| Premium +1 instance | 493.85 | 540.05 |
Editorial calculation: hourly fee ×730; outbound (GB−5)×$0.05; public IP/peering/recording storage/tax/discounts excluded; actual outbound rates vary by zone/direction.
Scale and concurrency: when to add instances
Basic has 2 fixed instances, about 40 RDP/80 SSH concurrent; Standard/Premium include 2 instances in the base price and scale to 50, up to about 1,000 RDP/2,000 SSH. At roughly 20 RDP+40 SSH per instance: 50 concurrent RDP sessions need at least 3 instances (2 base + 1 additional); 200 concurrent need at least 10. Instance count is not the only factor—VNet/peering, region, session type and Bastion CPU/network matter; leave headroom for peaks and scale down with metrics.
| Concurrency target | Estimated instances | Standard monthly (excl. traffic) |
|---|---|---|
| ≤40 RDP/80 SSH | 2 (base) | 211.70 |
| About 50 RDP | 3 (2+1) | 313.90 |
| About 200 RDP | 10 (2+8) | 1,029.30 |
| About 1,000 RDP | 50 (max) | 5,117.30 |
Editorial calculation: Standard $0.29 + additional $0.14/hour; 730 hours; 20 RDP/instance; actual concurrency depends on session type/load/region—benchmark.
Hidden costs: seven items beyond the hourly fee
Common add-ons: outbound transfer (first 5GB free, then by zone/direction), additional instances (Standard $0.14, Premium $0.22/hour), public IP (required for Basic/Standard, billed separately), VNet peering (cross-VNet/cross-region traffic), session recording/storage (Premium recording and log storage), AzureBastionSubnet (/26 or larger, consumes address space) and region/availability zone (multi-zone deployment/traffic). Developer is free but shared, one VM at a time and region-limited—not for production.
| Cost item | Trigger | Control |
|---|---|---|
| Outbound transfer | File transfer/long sessions | Compress, limit downloads, check zone |
| Additional instances | Concurrency/scaling | Headroom for peaks; scale down with metrics |
| Public IP | Basic/Standard deployment | Reuse/plan; Premium private-only |
| VNet peering | Cross-VNet/region | Central hub; reduce cross-region |
| Recording/storage | Premium audit | Retention by compliance; clean up |
| Subnet addresses | /26 or larger | Plan address space early |
| Region/AZ | Multi-zone deployment | Match RTO; avoid over-redundancy |
Sources: Azure Bastion pricing/SKU docs (9 November 2026). Editorial summary; billing follows official pages and bills.
How to choose: dev, production, audit and private network
For dev/test/temporary troubleshooting, Developer (free, but shared, one VM at a time, limited regions); small production with fixed concurrency, Basic; native client/custom ports/IP connect/shareable links/file transfer/scaling, Standard; session recording/audit/private-only, Premium (Microsoft also recommends Premium for production given the small price gap). Do not treat Bastion as a VPN: it is an operations session/jump host, not site-to-site VPN or full-tunnel remote access; for hybrid scenarios, split roles between Bastion and VPN/Private Link.
| Scenario | Prefer | Check first |
|---|---|---|
| Dev/test/temporary | Developer | Region, one VM at a time, shared |
| Small production/fixed concurrency | Basic | 40 RDP/80 SSH, no native client |
| Scaling/native client/custom ports | Standard | Instance count, IP connect, file transfer |
| Audit/recording/no public IP | Premium | Recording storage, private-only |
| Cross-VNet/multiple networks | Standard/Premium + peering | Peering traffic, hub design |
| Full-tunnel remote access | VPN/ZTNA, not Bastion | User/device scale, SLA |
Editorial selection framework, not a vendor recommendation; features/compliance/regional availability follow official docs and business requirements.
90-day checklist
Use the first 90 days to close “concurrency/sessions → SKU → network/address → pilot → cutover → review.” Weeks 1-2: inventory operators, concurrent sessions, protocols (RDP/SSH) and target VNets; weeks 2-4: choose SKU/instance count, public IP/private-only, /26 subnet; weeks 4-6: deploy a pilot and test concurrency/latency/file transfer; weeks 6-8: configure peering/NSG/audit; weeks 8-10: cut over and monitor sessions/traffic; weeks 10-12: cost review, scale down, renewal. Do not buy 50 instances “just in case.”
FAQ
How is Azure Bastion billed?
SKU hourly fee + outbound transfer (first 5GB/month free). Developer free; Basic $0.19/h; Standard $0.29/h (2 instances included); Premium $0.45/h (2 instances included); additional instances Standard $0.14, Premium $0.22/h.
What is the difference between Basic and Standard?
Basic has 2 fixed instances, 40 RDP/80 SSH, no native client/custom ports/IP connect/shareable links/file transfer; Standard scales to 50 instances and supports those features plus higher concurrency.
Is Premium worth it?
Yes when you need session recording/audit or private-only (no public IP). Microsoft notes the Standard/Premium price gap is small and recommends Premium for production; Basic/Standard suffice for a basic jump host.
How much is 100GB/month outbound?
Editorial estimates: Basic $143.45, Standard $216.45, Premium $333.25 (2 instances included); Standard+1 $318.65, Premium+1 $493.85. Actual outbound rates vary by zone/direction; first 5GB free.
How many concurrent sessions can Standard handle?
Two base instances support about 40 RDP/80 SSH; roughly 20 RDP/40 SSH per instance, up to 50 instances (~1,000 RDP/2,000 SSH). Actual concurrency depends on session type/load/region.
Do we need a public IP?
Basic/Standard require one; Premium supports private-only (no public IP). Public IP is billed separately—include it in the plan.
Can Bastion replace a VPN?
No. Bastion is a managed jump host/operations entry; it does not provide site-to-site or full-tunnel remote access. Use VPN/ZTNA for remote work/branch connectivity and Bastion for audited operations access.
Can Developer be used in production?
Not recommended. Developer is free but shared, one VM at a time and region-limited; it fits dev/test/temporary troubleshooting.
Research method and limitations
This article separates “official price facts” from “editorial calculations.” Developer/Basic/Standard/Premium hourly fees, additional instances and outbound tiers come from the Azure Bastion pricing page and Azure Retail Prices API (eastus, 9 November 2026); SKU features, instances/concurrency, scaling, private-only and the first-5GB-free rule come from Microsoft Learn's Bastion SKU comparison/overview. TCO, concurrency estimates, hidden costs and the 90-day checklist are editorial.
Eight limitations: (1) only eastus list prices, excluding tax/discounts/enterprise agreements; (2) outbound rates vary by zone/direction—the scenarios use $0.05/GB; (3) public IP/peering/recording storage/log combinations are excluded; (4) concurrency/instance estimates assume 20 RDP/40 SSH per instance and need benchmarking; (5) Developer's full regional limits are not covered; (6) no real session/file-transfer benchmark; (7) the full Bastion + VPN/ZTNA architecture is out of scope; (8) prices/features change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Bastion Pricing: azure.microsoft.com/en-us/pricing/details/azure-bastion. SKU hourly fees, additional instances, outbound, first 5GB free. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains Bastion, eastus): prices.azure.com/api/retail/prices. 0.19/0.29/0.45, 0.14/0.22, outbound tiers. Accessed 9 November 2026.
- Microsoft Learn, Choose the right Azure Bastion SKU: learn.microsoft.com/azure/bastion/bastion-sku-comparison. Features/concurrency/scaling/recording/private-only. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow the Azure official page and bill; this is not procurement, commercial or legal advice.