Azure ExpressRoute

About Azure ExpressRoute

Azure ExpressRoute is Microsoft's private connectivity service for linking on-premises networks, colocation facilities, and Azure without sending the primary data path across the public internet. It is designed for organizations that need private routing, predictable hybrid connectivity, sustained throughput, or stronger network control than an internet-based VPN can provide. ExpressRoute is not a complete network design by itself. Buyers still need a connectivity provider or ExpressRoute Direct, BGP routing, redundancy planning, and an ExpressRoute virtual network gateway when Azure private peering is used to reach virtual networks.

What is Azure ExpressRoute used for?

ExpressRoute is used for private hybrid connectivity between datacenters, offices, colocation sites, and Microsoft cloud services. A circuit terminates at an ExpressRoute peering location and includes redundant connections into Microsoft's network. With Azure private peering, organizations connect the circuit to Azure virtual networks through an ExpressRoute virtual network gateway.

Typical uses include large migrations, database replication, hybrid application tiers, centralized enterprise networking, and workloads where steady private connectivity is an operational requirement. ExpressRoute can also support Microsoft peering for eligible Microsoft public services when routing and service prerequisites are met.

How do provider circuits, ExpressRoute Direct, and Metro Direct differ?

Provider-based ExpressRoute circuits use a connectivity partner to reach a Microsoft peering location. Microsoft supports provider models such as Ethernet, IPVPN, exchange-provider colocation, and point-to-point Ethernet. Provider circuits are often the simpler choice when a carrier or exchange provider will manage the physical path into Microsoft's network.

ExpressRoute Direct lets an organization connect directly to Microsoft's network through a pair of dedicated ports at one peering location. Microsoft's current pricing page lists 10 Gbps, 100 Gbps, and 400 Gbps port-pair options. ExpressRoute Metro Direct uses the same port speeds across two peering locations within the same metropolitan area, adding location diversity for organizations that need direct connectivity and stronger site resilience.

What are Standard, High, and Maximum resiliency designs?

Microsoft currently describes three resiliency levels. Standard resiliency uses one circuit with two connections at a single peering location. It protects against a link or router failure inside that location but not against a location-wide outage, so Microsoft positions it for non-critical and non-production workloads.

High resiliency uses ExpressRoute Metro, where one circuit spans two peering locations in the same metropolitan area. Maximum resiliency uses two or more circuits in different physical ExpressRoute locations. Microsoft recommends maximum resiliency for critical and production workloads because it provides the strongest protection against location-wide failures.

What is ExpressRoute Resiliency Guard?

ExpressRoute Resiliency Guard is a Microsoft preview capability that helps customers choose and validate the resiliency model used by an ExpressRoute gateway. Its multi-homed maximum-resiliency configuration can connect the gateway to two or more circuits in different physical locations or to one or more ExpressRoute Metro circuits. The experience reports connectivity status and supports failover to a healthy location when one location becomes unavailable.

Because Resiliency Guard is still preview, it should be treated as guided configuration and validation rather than a replacement for architecture testing. Production teams still need to test circuit, gateway, provider, BGP, and application failover behavior.

How does ExpressRoute pricing work?

ExpressRoute has several billing dimensions rather than one universal price. Cost can depend on circuit or port speed, pricing zone, Local, Standard, or Premium scope, metered or unlimited data plan, ExpressRoute gateway, Global Reach, ExpressRoute Direct, Metro Direct, and provider charges outside Azure.

Microsoft's pricing page, checked September 5, 2026, states that inbound transfer is included with metered ExpressRoute while outbound transfer is billed by zone for Standard and Premium circuits. Local circuits do not use the same outbound transfer charge. Unlimited Data uses a higher fixed fee that includes inbound and outbound transfer. Global Reach has its own add-on and transfer charges. Provider, cross-connect, and managed-network charges can still apply separately.

What should buyers know about ExpressRoute gateway scaling?

Azure private peering requires an ExpressRoute virtual network gateway when the circuit connects to an Azure virtual network. Microsoft offers ErGwScale for customers that need flexible gateway capacity. It supports fixed scaling or autoscaling between configured minimum and maximum scale units.

Microsoft documents up to 40 scale units and up to 40 Gbps theoretical gateway bandwidth. Scale operations can take up to 30 minutes, so teams should not size the minimum only for average traffic when short spikes are business critical. Microsoft also states that IPsec over ExpressRoute is not currently supported on ErGwScale. For workloads that include Private Link traffic, Microsoft recommends fixed scaling rather than autoscaling.

What routing and packet limits matter?

ExpressRoute routing limits can become a design constraint before raw bandwidth does. Microsoft currently accepts up to 4,000 IPv4 prefixes and 100 IPv6 prefixes advertised to Microsoft through Azure private peering. The Premium add-on can raise the IPv4 private-peering prefix limit to 10,000. Microsoft peering accepts up to 200 prefixes per BGP session. Exceeding a prefix limit can cause the BGP session to drop.

At the gateway level, Microsoft says ExpressRoute can facilitate up to 11,000 routes spanning virtual network address spaces, on-premises networks, and relevant virtual-network peering connections. The maximum number of routes advertised by a gateway is 1,000. ExpressRoute gateways support a maximum TCP and UDP packet size of 1,400 bytes, and fragmented packets are not supported by the gateway path. Microsoft recommends FastPath when IP fragmentation support is required.

Can ExpressRoute bandwidth or pricing plans be reduced in place?

Some capacity and billing changes require more planning than a normal configuration toggle. Microsoft's pricing FAQ says a circuit can move from metered to unlimited without disruption, while moving from unlimited back to metered requires deleting and recreating the circuit in coordination with the provider.

Port speed can be increased, but reducing speed may also require circuit replacement and provider coordination depending on the connectivity model. Buyers that expect demand to fall should include downgrade procedures, maintenance windows, provider lead time, and rollback planning in the operating model.

How does ExpressRoute compare with Azure VPN Gateway?

Azure VPN Gateway uses encrypted tunnels over the public internet and is usually quicker and less expensive to start. ExpressRoute uses private connectivity through a provider or direct peering and is better suited to workloads that need private routing, predictable latency, sustained throughput, or a larger enterprise hybrid-network design.

Many enterprises use both. A site-to-site VPN can provide a backup path when ExpressRoute is unavailable, subject to supported coexistence and routing design. Organizations with light, intermittent, or administration-only hybrid traffic may not need ExpressRoute.

Who should choose something else?

Small teams with limited hybrid traffic, no provider or colocation relationship, and no firm private-connectivity requirement may find Azure VPN Gateway simpler to deploy and operate. Internet-facing applications do not need ExpressRoute merely because they run in Azure. Azure Private Link also solves a different problem by giving individual services private network access rather than providing a private wide-area path from on-premises locations.

Organizations should choose another design when they cannot justify provider coordination, BGP operations, gateway management, recurring connectivity cost, and resilience testing. If encrypted internet connectivity meets the workload's availability, latency, throughput, and security requirements, ExpressRoute can add complexity without enough buyer value.