MSDEVBUILD / azure

Azure ExpressRoute

Internet Office VNet 10.0.0.0/16 web subnet data subnet ✓NSG LOAD BAL. VNet 2 🗄️Storage (PaaS) Azure DNS ExpressRoute: a private, dedicated line that skips the internet
ExpressRoute is your own private road to Microsoft: no internet traffic jams, no strangers.

😟 THE PROBLEM

Huge nightly transfers over the internet are slow, unpredictable and worry regulators.

😊 THE SOLUTION

Connect privately to Azure with ExpressRoute.

  • Speeds vary on the internet✓ Dedicated bandwidth
  • Latency jumps around✓ Consistent, predictable latency
  • Regulators dislike internet paths✓ Traffic never touches the internet
🛠️ Solved with: Azure ExpressRoute
Module 2: Architecture & Services ⏱ 6 min read Updated 11 Nov 2026

Quick answer

Azure ExpressRoute extends your on-premises network into the Microsoft cloud over a private, dedicated connection provided by a connectivity partner. Traffic does not travel over the public internet, giving more reliability, faster speeds, consistent latency and higher security than typical internet connections.

Exam objective: 2.2.5 Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute. (Skills measured as of July 20, 2026)

Start with a question

A bank moves 10 TB a night between its datacenter and Azure. Should that ride on the public internet?

Probably not. It needs a private highway: ExpressRoute.

Explain it like I’m 10

The technical explanation

ExpressRoute connects your network to Microsoft through a connectivity provider using models such as co-location at a cloud exchange, point-to-point Ethernet, any-to-any (IP VPN) networks, or ExpressRoute Direct straight into Microsoft’s network.

VPN Gateway

  • Over the public internet
  • Encrypted tunnel
  • Quick and cheap to set up
  • Variable latency

ExpressRoute

  • Private connection, no internet
  • Through a connectivity partner
  • Higher bandwidth
  • Consistent latency, SLA-backed
VPN Gateway vs ExpressRoute

Real-world business scenario

Banking

A national bank

The problem
Nightly data transfers to Azure over VPN were slow and unpredictable, and regulators preferred traffic to avoid the public internet.
What they used
Redundant ExpressRoute circuits from two locations, with a VPN as backup.
Why that choice
Private, consistent, high-bandwidth connectivity.
The result
Nightly jobs finish reliably within their window.

When to use it and when not to

✓ Use it when…

  • Large, steady data transfers.
  • Latency-sensitive hybrid apps.
  • Compliance that prefers no internet path.

✕ Think twice when…

  • Small offices or temporary needs where VPN is cheaper and faster to set up.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is ExpressRoute?

Model answer

A private, dedicated connection between my company's network and Microsoft's cloud, provided by a telecom partner. It does not use the public internet.

Intermediate What are the benefits of ExpressRoute over a VPN?

Model answer

Traffic stays off the internet, latency is consistent, bandwidth is higher, and reliability is backed by an SLA with redundant connections. It can also connect to Microsoft services such as Microsoft 365 as well as Azure.

Experienced developer How would you design resilient hybrid connectivity with ExpressRoute?

Model answer

Use circuits in two different peering locations, connect them to zone-redundant gateways, and keep a site-to-site VPN as a failover path. For multi-region estates, consider ExpressRoute Global Reach or Virtual WAN for site-to-site transit.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which service provides a private connection to Azure that does NOT go over the public internet?

Question 2

Question 2 of 3 · Select 2

Which TWO are benefits of ExpressRoute?

Question 3

Question 3 of 3

Who typically provides the physical connection for ExpressRoute?

Quick revision

Key points

  • ExpressRoute = private, dedicated connection to Microsoft cloud.
  • Does not use the public internet.
  • More reliable, faster, consistent latency, higher security.
  • Provided through connectivity partners.

Important terminology

ExpressRoute circuit
The logical private connection between your network and Microsoft through a provider.
Connectivity provider
A telecom or exchange partner that provides the physical connection.
ExpressRoute Global Reach
Connects your on-premises sites to each other through the Microsoft network.

Common mistakes

  • Saying ExpressRoute is encrypted VPN over the internet. That describes VPN Gateway.

Exam tips

  • "Private connection that does not go over the internet" = ExpressRoute.

Five quick revision questions

  1. 1.Does ExpressRoute use the public internet?Show

    No.

  2. 2.Who provides the physical connection?Show

    A connectivity provider (partner).

  3. 3.Name two benefits of ExpressRoute.Show

    Consistent latency and higher reliability (also speed and security).

  4. 4.Which feature connects on-premises sites to each other via Microsoft?Show

    ExpressRoute Global Reach.

  5. 5.What is a common backup for ExpressRoute?Show

    A site-to-site VPN.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure DNS