MSDEVBUILD / azure

Azure VPN Gateway

Internet Office VNet 10.0.0.0/16 web subnet data subnet ✓NSG LOAD BAL. VNet 2 🗄️Storage (PaaS) Azure DNS VPN Gateway: an encrypted tunnel over the public internet
A VPN wraps your data in an encrypted tunnel, so it can travel safely across the public internet.

😟 THE PROBLEM

Shops must reach a system in Azure, but a private line to each one is too expensive.

😊 THE SOLUTION

Use an encrypted site-to-site VPN over existing internet lines.

  • Private lines cost too much✓ Use existing internet, encrypted
  • Staff work from home✓ Point-to-site VPN per laptop
  • Data could be read in transit✓ IPsec encryption
🛠️ Solved with: Azure VPN Gateway
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Azure VPN Gateway sends encrypted traffic between an Azure virtual network and another location over the public internet. Common uses are site-to-site (connect your office network), point-to-site (connect individual laptops) and VNet-to-VNet connections.

Exam objective: 2.2.5 Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute. (Skills measured as of July 20, 2026)

Start with a question

How does your office talk to Azure privately if the only road between them is the public internet?

You build a tunnel: an encrypted VPN connection that wraps your data so nobody on the internet can read it.

Explain it like I’m 10

The technical explanation

A VPN gateway is deployed into a dedicated GatewaySubnet in your VNet and uses IPsec/IKE encryption.

TypeConnectsTypical use
Site-to-siteOn-premises network ↔ AzureBranch or head office
Point-to-siteIndividual device ↔ AzureRemote workers, admins
VNet-to-VNetAzure VNet ↔ Azure VNetEncrypted link between VNets

Real-world business scenario

Retail

A regional retail chain

The problem
Stores needed to reach a stock system in Azure, but a private line to every store was too expensive.
What they used
Site-to-site VPN from each store router to an Azure VPN Gateway.
Why that choice
Encrypted connectivity over existing internet lines at low cost.
The result
All stores connected within weeks using existing broadband.

When to use it and when not to

✓ Use it when…

  • Affordable encrypted connectivity to offices or remote users.
  • Backup path for ExpressRoute.

✕ Think twice when…

  • Very high-bandwidth, latency-sensitive or no-internet requirements (use ExpressRoute).
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What does Azure VPN Gateway do?

Model answer

It creates an encrypted tunnel over the internet between Azure and my office, or between Azure and individual laptops, so traffic is private even though it crosses the public internet.

Intermediate What is the difference between site-to-site and point-to-site?

Model answer

Site-to-site connects a whole network, like an office, using a VPN device on-premises. Point-to-site connects individual computers, like remote workers, using a VPN client on each device.

Experienced developer When is VPN Gateway not enough?

Model answer

When you need predictable latency, very high bandwidth or traffic that never touches the internet, for example large data transfers or strict compliance. Then use ExpressRoute, often with a VPN as a backup path.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which service creates an encrypted connection between an office network and Azure over the public internet?

Question 2

Question 2 of 3

Remote employees need to connect their individual laptops securely to an Azure VNet. What should you configure?

Question 3

Question 3 of 3

How many VPN gateways can you deploy in one virtual network?

Quick revision

Key points

  • VPN Gateway encrypts traffic over the public internet.
  • Site-to-site = office network; point-to-site = individual devices; VNet-to-VNet also supported.
  • One VPN gateway per virtual network.
  • Can be made highly available (active-active, zone-redundant).

Important terminology

VPN gateway
A virtual network gateway that creates encrypted IPsec/IKE tunnels over the internet.
Site-to-site
Connects an entire on-premises network to Azure.
Point-to-site
Connects individual devices, such as a laptop, to Azure.
Route-based VPN
Uses routes to decide which traffic goes into the tunnel; the most common and flexible type.

Common mistakes

  • Confusing VPN Gateway (internet, encrypted) with ExpressRoute (private, not internet).

Exam tips

  • "Encrypted connection over the public internet" = VPN Gateway.

Five quick revision questions

  1. 1.Does VPN Gateway traffic go over the internet?Show

    Yes, encrypted.

  2. 2.What connects a whole office to Azure?Show

    A site-to-site VPN.

  3. 3.What connects one laptop to Azure?Show

    A point-to-site VPN.

  4. 4.How many VPN gateways can a VNet have?Show

    One.

  5. 5.What is the private, non-internet alternative?Show

    ExpressRoute.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure ExpressRoute