About Azure Relay
Azure Relay is a managed Azure integration service for connecting applications across network boundaries without requiring an inbound firewall opening on the service side. It is designed for scenarios where an application running in a corporate network, private network, or restricted environment must be reached by a client or cloud application through a relay endpoint. Microsoft currently offers two Relay capabilities: Hybrid Connections for standards-based HTTP and WebSocket communication, and WCF Relay for older Windows Communication Foundation applications.
What is included
Connectivity
| Modern relay model | Hybrid Connections using HTTP, HTTPS, and WebSockets |
|---|---|
| Legacy model | WCF Relay for Windows Communication Foundation applications |
Security
| Authentication | Microsoft Entra ID with Azure RBAC or Shared Access Signatures |
|---|---|
| Private access | Azure Private Link private endpoints supported |
Scale
| Concurrent listeners per relay | 25 |
|---|---|
| Concurrent relay connections per namespace | 5,000 |
| Relay endpoints per namespace | 10,000 |
Networking
| Hybrid Connections transport | TLS-secured WebSockets on port 443 |
|---|
Pricing
| Hybrid Connections billing | Listener-based with 5 GB monthly data allowance per connection before additional data charges |
|---|---|
| WCF Relay billing | Relay-hour and message-volume meters |
What problems does Azure Relay solve?
Azure Relay is useful when a service must remain inside an existing network but still needs to communicate with applications outside that network. The service side establishes an outbound connection to Azure Relay, and clients connect to the Relay endpoint rather than directly to the private service. This removes the need to publish the service through an inbound firewall rule or expose its network location directly. Common fits include hybrid application integration, exposing a selected on-premises application endpoint to a cloud application, bi-directional communication across NAT or firewall boundaries, and transitional architectures where moving the underlying service to Azure is not yet practical. Relay is more application-specific than a VPN because it can expose one endpoint instead of extending network-level connectivity.
How do Hybrid Connections and WCF Relay differ?
Hybrid Connections is the modern, standards-based Azure Relay option. Microsoft documents it as using HTTP, HTTPS and WebSockets, so it can work across multiple platforms and languages. Current Microsoft quickstarts include .NET, Node.js, Java and Python examples. It supports request-response communication and bi-directional streams without requiring the listener to accept inbound connections from the public internet. WCF Relay is the older model built for Windows Communication Foundation applications. Microsoft still documents and supports it for customers with existing WCF programming models, but calls it the legacy relay offering. New cross-platform integration work should normally evaluate Hybrid Connections first unless the application specifically depends on WCF Relay bindings.
How does Azure Relay networking work?
For Hybrid Connections, the listening application creates an outbound connection to the Relay service. A sender then connects to the Azure Relay address, and Relay joins the sender with an available listener. Microsoft documents Hybrid Connections as using TLS-secured WebSockets on port 443 for the underlying transport. This architecture means the listener can remain behind NAT or a firewall without accepting a direct inbound connection from the sender. Azure Relay is not a general network tunnel. It relays application traffic for configured Relay endpoints and does not replace private network connectivity such as VPN Gateway, ExpressRoute, or Virtual WAN when a team needs broader network-to-network reachability.
What authentication and network security options are available?
Microsoft supports both Microsoft Entra ID and Shared Access Signatures for Azure Relay authorization. Microsoft recommends Entra ID when possible because Azure RBAC can grant Azure Relay Owner, Listener, or Sender permissions without storing long-lived shared access keys in application code. Managed identities can also be used by supported Azure-hosted clients. At the network layer, Relay namespaces support IP firewall rules and private endpoints through Azure Private Link. Microsoft states that service endpoints are not supported. Private endpoints can restrict access to specific Relay namespaces over private IP connectivity, although Relay listeners using Private Link require the documented outbound port range in addition to standard Relay ports.
What are the main Azure Relay limits?
Current Microsoft Relay quotas include up to 1,000 Relay namespaces per Azure subscription, 25 concurrent listeners on one Relay entity, 5,000 concurrent Relay connections across all endpoints in a service namespace, and 10,000 Relay endpoints per service namespace. Microsoft also documents 128 virtual network and IP filter rules per namespace. Message-size behavior depends on the Relay model and binding. NetOnewayRelayBinding and NetEventRelayBinding messages have a documented 64 KB limit, while some other WCF Relay bindings do not have the same message-size cap. Private Link also has separate limits, including up to 64 private endpoints per Relay namespace.
How is Azure Relay priced?
Pricing was checked on August 27, 2026. Microsoft currently publishes Relay pricing on the Azure Service Bus pricing page because Relay remains part of the broader Service Bus platform. Hybrid Connections are billed per listener unit, with an included monthly data allowance and additional data charges after that allowance is exceeded. Microsoft currently describes the included Hybrid Connections data amount as 5 GB per month per connection. WCF Relay uses relay-hour and message-volume meters. Exact currency rates vary by region, agreement, and currency, so this page does not present one universal monthly figure. Buyers should also account for Azure Private Link or other connected Azure services if they add those capabilities.
How does Azure Relay compare with Service Bus, VPN Gateway, and Private Link?
Azure Relay should not be confused with Azure Service Bus queues and topics. Service Bus is designed for durable brokered messaging, while Relay connects clients to listening services and forwards application traffic without acting as a durable queue. VPN Gateway and ExpressRoute operate at the network-connectivity layer and are better when multiple systems need broader private network access. Azure Private Link privately exposes supported Azure services and customer services through private endpoints, while Azure Relay can bridge a specific listener and sender across network boundaries. A team should choose based on whether it needs durable messages, application-level relaying, or network-level connectivity.
What operational tradeoffs should buyers consider?
Relay reduces inbound firewall exposure, but it creates a dependency on the Relay namespace, client libraries, listener availability, and the application's reconnect behavior. It does not make the underlying application highly available by itself. If only one listener is running and that process fails, Relay has no healthy application instance to forward traffic to. Teams should plan listener redundancy, health monitoring, retry behavior, authentication rotation, and network rules. The product is also a more specialized integration choice than a normal API gateway or message broker, so long-term architecture should consider whether the application will eventually move to a managed Azure service where Relay is no longer necessary.
Who should choose something else?
Choose Azure Service Bus when the application needs durable queues, topics, dead-lettering, transactions, or asynchronous message processing rather than a live relayed connection. Choose VPN Gateway, ExpressRoute, or Virtual WAN when the requirement is broad network connectivity between environments. Choose Azure API Management when the main need is API publishing, policy, authentication, throttling, and developer onboarding. Choose Azure Private Link when the target service can be exposed directly through a private endpoint without an application relay. Teams building new cloud-native applications with no private listener or hybrid network constraint usually do not need Azure Relay at all.
Reviews
No reviews yet
Nobody has reviewed Azure Relay here yet.