What's changed: Deepened AZ-700 Chapter 2 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
2.2Private Connectivity with ExpressRoute
Understand ExpressRoute, which connects on-prem and Azure over a dedicated, private connection that bypasses the internet. Choose it over VPN for enterprise connectivity needing high bandwidth, low latency, and stability.
VPN runs over the internet, so latency/bandwidth can be unstable. ExpressRoute is a dedicated private connection via a connectivity provider, offering stable high bandwidth and low latency.
2.2.1ExpressRoute building blocks
- Private connection: a dedicated connection that bypasses the internet; high bandwidth, low latency, stable.
- Private peering: privately connect to resources inside VNets.
- Microsoft peering: used to connect to public services like Microsoft 365.
- Redundancy and SKU: redundant dual connections by default; land in the VNet via an ExpressRoute Gateway; Global Reach can link sites.
Common on AZ-700: dedicated private connection bypassing the internet = ExpressRoute, private connectivity to VNets = private peering, public services like Microsoft 365 = Microsoft peering, link sites via ExpressRoute = Global Reach. Choose ExpressRoute for stability/bandwidth, VPN for cost/small scale.
A common design pairs ExpressRoute with VPN as a failover path if ExpressRoute fails—frequently tested.
ExpressRoute circuits come in connectivity models—CloudExchange colocation, point-to-point Ethernet, and Any-to-Any (IPVPN)—with bandwidth from 50 Mbps to 100 Gbps. Billing is metered or unlimited; unlimited favors egress-heavy workloads. All route exchange uses BGP: private peering advertises VNet prefixes, Microsoft peering advertises public-service prefixes. For availability, circuits are a redundant pair by default, and meeting the SLA requires keeping both paths. To share one circuit across VNets, place an ExpressRoute Gateway in each VNet or aggregate at a Virtual WAN hub. Global Reach links distant on-prem sites via the ExpressRoute circuit; for stronger encryption, add MACsec (layer-2) or IPsec/VPN over ExpressRoute. Versus VPN: ExpressRoute is dedicated, stable, and high-bandwidth but has longer lead time and higher cost, whereas VPN is immediate and cheap but depends on internet quality.
| Aspect | VPN Gateway | ExpressRoute |
|---|---|---|
| Path | Over the internet (encrypted) | Dedicated, bypasses internet |
| Bandwidth/latency | Moderate, variable | High, low, stable |
| Setup/cost | Immediate, cheap | Provider lead time, higher cost |
| Encryption | IPsec by default | Unencrypted by default (add MACsec/IPsec) |
Scenario: a core system needs stable high-bandwidth connectivity but must keep minimal connectivity during a circuit outage. → Use ExpressRoute (private peering) as the primary and a site-to-site VPN as a backup path. BGP metrics prefer ExpressRoute normally and fail over to VPN on an outage.
FAQ: Q. Does ExpressRoute encrypt data? → A. It’s a dedicated circuit but not encrypted by default; add MACsec or IPsec/VPN over ExpressRoute if required. Q. Private vs Microsoft peering? → A. Private peering is private connectivity to VNet resources; Microsoft peering is for public services like Microsoft 365.
Trap: “ExpressRoute is a private circuit, so traffic is automatically encrypted” is wrong—private means isolated, but it’s not encrypted by default (add MACsec/IPsec). Also “ExpressRoute goes over the internet” is wrong—bypassing the internet is the decisive difference from VPN.
2.2.2Section summary
- ExpressRoute = dedicated private connection (bypasses internet, high bandwidth/low latency)
- Peering = private (VNets) / Microsoft (public services)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want high-bandwidth, low-latency on-prem-to-Azure connectivity over a dedicated private connection (no internet). What do you use?
Q2. Which ExpressRoute peering provides private connectivity to resources inside VNets?
Q3. Which correctly distinguishes VPN from ExpressRoute?