Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure Virtual WAN Standard Hub is $0.25/hour ≈ $182.50/month and hub data processing is $0.02/GB ($20.48/TB). VPN S2S scale units are $0.361/hour ($263.53/month per 500 Mbps) and S2S connections $0.05/hour ($36.50/month per connection); ExpressRoute scale units are $0.42/hour ($306.60/month per 2 Gbps) and ER connections $0.05/hour ($36.50/month per connection); P2S scale units are $0.361/hour and P2S connection units $0.0125/hour. Examples: 1 hub + 10 S2S + 1 scale unit + 1 TB/month = $831.51/month; two scale units = $1,095.04; 2 hubs + 20 S2S + 4 scale units + 5 TB = $2,251.52; 1 hub + 2 ER circuits + 1 ER scale unit + 10 TB = $766.90. Note that VNet connections still incur VNet peering charges, VPN/ER data transfer bills separately, and Basic supports only S2S VPN while Standard adds P2S/ER/inter-hub and VNet transit.
This guide is for network architects, cloud platform/SRE, finance and procurement teams designing global branch connectivity, SD-WAN to Azure, ExpressRoute aggregation or replacing a self-built hub-and-spoke. It explains Basic/Standard, hub/data processing/connection units/scale units, S2S/ER/P2S TCO, Secure Hub/NVA, routing infrastructure, the hub-and-spoke boundary and a 90-day checklist. Prices come from the Azure Virtual WAN pricing page, the Azure Retail Prices API and Microsoft Learn (eastus, 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) The vWAN bill = hub + data processing + connection units + scale units; data processing is per GB and can exceed the hub itself at volume. (2) A scale unit is bandwidth (VPN 500 Mbps, ER 2 Gbps); a connection unit is branch/circuit count, billed separately. (3) VNet connections still incur peering charges, VPN/ER data transfer bills separately, and Basic supports only S2S while Standard adds P2S, ER, inter-hub and VNet transit.
Basic vs Standard: capabilities decide whether it fits
Virtual WAN comes in Basic and Standard. Basic supports only site-to-site VPN, does not mesh hubs and cannot adjust scale units; Standard supports P2S, ExpressRoute, S2S, inter-hub and VNet-to-VNet transit, and Azure Firewall/NVA, with all hubs automatically meshed. Basic can upgrade to Standard but cannot revert. If you need ER, P2S or global any-to-any, model Standard from the start rather than starting on Basic and migrating.
| Capability | Basic | Standard |
|---|---|---|
| Site-to-Site VPN | Yes | Yes |
| Point-to-Site (User VPN) | No | Yes |
| ExpressRoute | No | Yes |
| Inter-hub / VNet-to-VNet transit | No (hubs not meshed) | Yes (hubs automatically meshed) |
| Azure Firewall / NVA | No | Yes |
| Adjust gateway scale units | No | Yes |
| Hub fee | Standard Hub fee not listed | $0.25/hour |
| Upgrade | Can upgrade to Standard, no revert | — |
Sources: Learn "Azure Virtual WAN overview" and "Virtual WAN FAQ" (9 November 2026). The Basic hub fee is not separately listed on the pricing page, but S2S connection/scale units and data transfer may still apply; check the actual bill.
Billing units: hub, data processing, connections and scale units
The Standard fixed fee is hub $0.25/hour; enabling route maps or a third-party Firewall Manager policy raises the hub to $0.40/hour. Traffic pays $0.02/GB in hub data processing. VPN S2S bills $0.361/hour per 500 Mbps scale unit plus $0.05/hour per connection; ER bills $0.42/hour per 2 Gbps scale unit plus $0.05/hour per connection; P2S bills $0.361/hour per 500 Mbps scale unit plus $0.0125/hour per connection unit. Hub routing includes the first 2,000 VMs, then $0.10/hour per additional 1,000 VMs.
| Meter | Unit price | Monthly (730h) | Basis |
|---|---|---|---|
| Standard Hub | $0.25/hour | 182.50 | Per hub/deployment hour |
| Hub + route map/third-party firewall policy | $0.40/hour | 292.00 | Replaces the $0.25 tier |
| Hub data processing | $0.02/GB | 20.48/TB | Traffic through the hub router |
| VPN S2S scale unit | $0.361/hour | 263.53 | 500 Mbps/unit, up to 20 Gbps |
| VPN S2S connection | $0.05/hour | 36.50 | Per branch connection, up to 1,000/region |
| VPN P2S scale unit | $0.361/hour | 263.53 | 500 Mbps/unit |
| VPN P2S connection unit | $0.0125/hour | 9.13 | Per connection unit |
| ExpressRoute scale unit | $0.42/hour | 306.60 | 2 Gbps/unit |
| ExpressRoute connection | $0.05/hour | 36.50 | Per circuit connection |
| Routing Infrastructure Unit | $0.10/hour | 73.00 | Per 1,000 VMs above 2,000 |
| NVA Infrastructure Unit | $0.25/hour | 182.50 | 500 Mbps/unit |
| NVA data processing | $0.005/GB | 5.12/TB | Load balancer related |
Sources: Azure Virtual WAN pricing page and Azure Retail Prices API (eastus, 9 November 2026). Hub data processing is traffic through the Virtual WAN hub router; VPN/ER data transfer, VNet peering, ER circuits and NVA marketplace licences are extra.
Four TCO scenarios: single hub, dual hub, ER, P2S
At 730 hours, Standard, excluding peering/data transfer/ER circuits/NVA licences: 1 hub + 10 S2S + 1 scale unit + 1 TB/month = $831.51 (hub 182.50 + connections 365.00 + scale 263.53 + data 20.48); adding a second scale unit (1 Gbps) gives $1,095.04. 2 hubs + 20 S2S + 4 scale units + 5 TB = $2,251.52 (hubs 365.00 + connections 730.00 + scale 1,054.12 + data 102.40). 1 hub + 2 ER circuits + 1 ER scale unit + 10 TB = $766.90 (hub 182.50 + ER connections 73.00 + ER scale 306.60 + data 204.80). 1 hub + 1 P2S scale + 1 P2S connection unit + 1 TB = $475.64.
| Scenario | Hub | Connections | Scale | Data | Total/month |
|---|---|---|---|---|---|
| 1 hub + 10 S2S + 1 scale + 1 TB | 182.50 | 365.00 | 263.53 | 20.48 | 831.51 |
| 1 hub + 10 S2S + 2 scale + 1 TB | 182.50 | 365.00 | 527.06 | 20.48 | 1,095.04 |
| 2 hubs + 20 S2S + 4 scale + 5 TB | 365.00 | 730.00 | 1,054.12 | 102.40 | 2,251.52 |
| 1 hub + 2 ER + 1 ER scale + 10 TB | 182.50 | 73.00 | 306.60 | 204.80 | 766.90 |
| 1 hub + 1 P2S scale + 1 P2S conn + 1 TB | 182.50 | 9.13 | 263.53 | 20.48 | 475.64 |
| 1 hub + 3,000 VM routing | — | — | 73.00 | — | 73.00 (routing only) |
Editorial calculation: 730 hours/month; hub 0.25, S2S connection 0.05, S2S scale 0.361, ER connection 0.05, ER scale 0.42, P2S scale 0.361, P2S connection 0.0125, routing 0.10; data 0.02/GB, 1 TB = 1,024 GB. Excludes VNet peering, VPN/ER data transfer, ER circuits, NVA/Firewall licences, tax and discounts.
Secure Hub, NVA and routing infrastructure
For centralised security, use Azure Firewall or a third-party NVA. A hub with a third-party Firewall Manager policy is $0.40/hour (instead of $0.25) plus $0.02/GB; NVA Infrastructure is $0.25/hour per 500 Mbps plus $0.005/GB, with the NVA marketplace licence extra. Example: 1 hub + 2 NVA units (1 Gbps) + 5 TB = $785.00/month (hub 292.00 + NVA infra 365.00 + hub data 102.40 + NVA data 25.60), excluding the NVA licence. Hub routing includes the first 2,000 VMs; 3,000/4,000/5,000 VMs add $73.00/$146.00/$219.00.
| Item | Price | Example |
|---|---|---|
| Third-party firewall policy hub | $0.40/hour + $0.02/GB | 292.00 + 102.40 (5 TB) |
| NVA Infrastructure | $0.25/hour per 500 Mbps | 2 units = 365.00 |
| NVA data processing | $0.005/GB | 5 TB = 25.60 |
| Secure Hub total | — | 785.00 + NVA licence |
| Routing, 2,000 VMs | Included | 0 |
| Routing, 3,000/4,000/5,000 VMs | $0.10/hour/1,000 VMs | 73.00/146.00/219.00 |
Sources: Azure Retail Prices API (eastus, 9 November 2026) and pricing-page footnotes. Azure Firewall Secured Virtual Hub pricing is on the Azure Firewall page; NVA marketplace licences are charged by the third party.
vWAN vs self-built hub-and-spoke: cost is not the only dimension
vWAN replaces self-built VNets, peering, UDRs, VPN/ER gateways and NVAs with a Microsoft-managed hub: a Standard hub is automatically meshed and any-to-any, suiting many branches/regions; self-built hub-and-spoke gives more control but requires maintaining routing, gateways, firewalls and peering. On cost, vWAN's explicit fees are hub/data processing/connections/scale units; the self-built option spreads cost across VNet peering, VPN/ER gateways, firewall/NVA and operations. Both must include VNet peering and data transfer; comparing only the hub hourly fee is misleading.
| Dimension | vWAN Standard | Self-built hub-and-spoke |
|---|---|---|
| Hub management | Microsoft-managed | Customer VNets/gateways/routing |
| Branch/region connectivity | Automatic mesh, any-to-any | UDR/peering/firewall orchestration |
| Explicit cost | Hub + data + connections + scale | Peering + gateways + firewall/NVA |
| Scaling | VPN 500 Mbps/unit, ER 2 Gbps/unit | Gateway SKUs/instances |
| Operations | Single control plane, less self-build | More control, more operations |
| Best for | Many branches/regions/global transit | Few VNets/custom routing |
Editorial summary, not a vendor recommendation; actual TCO should include peering, data transfer, ER circuits, Firewall/NVA licences and staff time. Sources: Learn Virtual WAN docs and pricing page (9 November 2026).
Hidden costs and cost levers
Seven common extras: VNet peering (same-region/global; vWAN does not exempt it), VPN/ER data transfer (regular data-transfer rates), ER circuit/port, Azure Firewall/NVA licences, the $0.40/hour hub for route maps/third-party firewall policy, routing units above 2,000 VMs, and multiple hubs/hub-to-hub traffic. Data processing at $0.02/GB becomes the main line at volume: 100 TB/month = $2,048, already more than a hub's $182.50; estimate traffic before choosing hub count and scale units.
| Cost item | Trigger | Control |
|---|---|---|
| Hub data processing | GB through the hub router | Local breakout, avoid tromboning |
| VNet peering | VNet connection to hub | Same-region placement, fewer cross-region links |
| VPN/ER data transfer | Egress/cross-region | Nearest hub, compression/caching |
| ER circuit/port | Private circuit | Match bandwidth and provider terms |
| Firewall/NVA licence | Secure Hub | Size units by throughput, avoid overbuying |
| Route map/third-party policy hub | $0.40/hour instead of 0.25 | Enable only when required |
| Routing units | Above 2,000 VMs | Control VMs per hub |
| Multiple hubs/hub-to-hub | Global multi-region | Place hubs by latency/compliance |
Editorial summary; sources: pricing page, Retail API and Learn FAQ (9 November 2026). Exact billing for hub-to-hub and P2S connection units follows the purchase page/bill.
90-day optimization checklist
Use 90 days to move through "inventory → tier → traffic → security → review". Weeks 1–2: count branches, bandwidth per branch, ER circuits, P2S users, VNets, cross-region traffic and current peering/gateway bills. Weeks 2–4: confirm whether Basic (S2S only) is enough; if ER/P2S/transit is needed, model Standard directly. Weeks 4–6: size S2S/ER scale units by peak bandwidth and connection units by branch/circuit count. Weeks 6–8: evaluate Secure Hub/NVA throughput and licences, avoiding units sized for peak. Weeks 8–10: consolidate or downsize non-production hubs and check whether route maps/third-party policies are always on. Weeks 10–12: review data processing, peering, data transfer and routing units, and adjust hub count to actual traffic.
FAQ
How is Azure Virtual WAN billed?
Standard Hub $0.25/hour ($182.50/month) and hub data processing $0.02/GB; VPN S2S scale unit $0.361/hour per 500 Mbps and S2S connection $0.05/hour; ER scale unit $0.42/hour per 2 Gbps and ER connection $0.05/hour; P2S scale unit $0.361/hour and P2S connection unit $0.0125/hour. VNet peering, VPN/ER data transfer, ER circuits and Firewall/NVA licences are extra.
How much is a Standard Hub per month?
$0.25/hour × 730 = $182.50/month; with route maps or a third-party Firewall Manager policy the hub is $0.40/hour = $292.00/month. Data processing is $0.02/GB: about $20.48 per TB, $2,048 per 100 TB.
What is the difference between a scale unit and a connection unit?
A scale unit is bandwidth: VPN 500 Mbps per unit, ER 2 Gbps per unit. A connection unit is count: S2S $0.05/hour per branch, ER $0.05/hour per circuit, P2S $0.0125/hour per connection unit. They bill separately; adding bandwidth does not add branches.
How much is one hub with 10 branches?
With one S2S scale unit and 1 TB/month: hub 182.50 + 10 connections 365.00 + scale 263.53 + data 20.48 = $831.51/month; two scale units (1 Gbps) = $1,095.04/month. Excludes peering, data transfer, tax and discounts.
How is data processing calculated?
At $0.02/GB ($20.48/TB) for traffic through the Virtual WAN hub router. It is separate from VPN/ER data transfer: the former is hub forwarding, the latter is egress/cross-region transfer. At volume, estimate GB first, then decide hub count and local breakout.
Basic vs Standard: which one?
Basic supports only S2S VPN, does not mesh hubs and cannot adjust scale units; Standard supports P2S, ER, S2S, inter-hub, VNet transit and Firewall/NVA. If you need ER/P2S/global any-to-any, go Standard; Basic can upgrade to Standard but cannot revert.
How does vWAN compare with self-built hub-and-spoke?
Compare vWAN's hub, data processing, connections and scale units against self-built peering, VPN/ER gateways, firewall/NVA and staff time on the same basis. vWAN saves hub/gateway/routing operations and gives automatic any-to-any; self-built avoids the explicit hub fee but may cost more in peering, gateways and firewalls.
What are the hidden costs?
VNet peering (same-region/global), VPN/ER data transfer, ER circuit/port, Azure Firewall/NVA licences, the $0.40/hour hub for route maps/third-party policy, routing units above 2,000 VMs, and multiple hubs/hub-to-hub traffic. Data processing at $0.02/GB can be the largest line at volume.
Research method and limitations
This article separates "official price facts" from "editorial calculations": Standard Hub $0.25, $0.40 (route map/third-party policy), data processing $0.02, S2S scale $0.361, S2S connection $0.05, P2S scale $0.361, P2S connection $0.0125, ER scale $0.42, ER connection $0.05, routing $0.10, NVA infra $0.25 and NVA data $0.005 come from the Azure Retail Prices API (eastus, 9 November 2026); Basic/Standard capabilities, automatic hub mesh, separate VNet peering and VPN/ER data transfer, S2S/ER/P2S scale-unit capacities and the 2,000-VM routing rule come from the Azure Virtual WAN pricing page and Microsoft Learn (overview, FAQ).
Eight limitations: (1) only eastus list prices, excluding tax/CSP/enterprise discounts; (2) 730-hour months; (3) the main TCO excludes VNet peering, VPN/ER data transfer, ER circuits, Firewall/NVA licences, hub-to-hub, tax; (4) exact billing for P2S connection units and hub-to-hub follows the purchase page/bill; (5) the Basic hub fee is not separately listed, so no Basic TCO is modelled; (6) no real throughput/latency benchmark, so scale units should be sized on peak, not average; (7) Azure Firewall Secured Hub pricing is not covered; (8) prices/features/regions change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Virtual WAN Pricing: azure.microsoft.com/en-us/pricing/details/virtual-wan. Standard Hub, data processing, S2S/ER/P2S scale and connection units, routing, NVA, Secure Hub. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains Virtual WAN, eastus): prices.azure.com/api/retail/prices. $0.25/$0.40/$0.02, $0.361/$0.05, $0.42/$0.05, $0.0125, $0.10, $0.25/$0.005. Accessed 9 November 2026.
- Microsoft Learn, Azure Virtual WAN overview: learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about. Basic/Standard capabilities, automatic hub mesh, VNet peering and data transfer notes. Accessed 9 November 2026.
- Microsoft Learn, Virtual WAN FAQ: learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-faq. S2S/P2S scale-unit capacity, connection limits, routing units and billing boundaries. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.