Azure ExpressRoute

About Azure ExpressRoute

Azure ExpressRoute is Microsoft's private connectivity service for linking on-premises networks, colocation facilities, and selected Microsoft cloud services without sending the primary data path across the public internet. It is designed for organizations that need more predictable network performance, private routing, higher throughput, or stronger connectivity controls than an internet-based VPN can provide. ExpressRoute is not a replacement for every VPN connection: it normally requires a connectivity provider or ExpressRoute Direct, routing configuration, and additional Azure gateway resources when private peering is used with virtual networks.

What is Azure ExpressRoute used for?

ExpressRoute is commonly used for hybrid cloud connectivity between datacenters, offices, colocation sites, and Azure virtual networks. A circuit terminates at an ExpressRoute peering location and provides redundant links into Microsoft's network. For Azure private peering, organizations typically connect the circuit to one or more Azure virtual networks through an ExpressRoute virtual network gateway.

The service fits workloads where network predictability matters, including large migrations, database replication, hybrid application tiers, centralized enterprise networks, and steady traffic between on-premises systems and Azure. It can also be used for access to supported Microsoft public services through Microsoft peering when the required routing and service conditions are met.

How do ExpressRoute circuits and connectivity models work?

Microsoft supports several connectivity models, including provider-based Ethernet or IPVPN services, exchange-provider colocation, point-to-point Ethernet, and ExpressRoute Direct. Provider-based circuits use a connectivity partner to reach a Microsoft peering location. ExpressRoute Direct lets organizations connect directly to Microsoft's global network through dedicated port pairs at supported peering locations.

A standard provider circuit has two redundant connections at the peering location. Microsoft currently offers circuit bandwidths from 50 Mbps through 10 Gbps for provider circuits. ExpressRoute Direct currently offers 10 Gbps, 100 Gbps, and 400 Gbps port pairs. Choosing between provider connectivity and Direct depends on scale, peering-location access, operational maturity, and whether the organization needs very high aggregate bandwidth.

What are Local, Standard, Premium, and Metro options?

ExpressRoute circuit scope depends on the selected SKU and resiliency design. Local circuits are limited to nearby Azure regions associated with the peering location. Standard circuits provide access to Azure regions within the same geopolitical area. Premium extends connectivity globally and raises several route and virtual-network-link limits.

Microsoft currently documents Premium private and public peering route limits of 10,000 routes compared with 4,000 for Standard. ExpressRoute Metro provides site diversity across two peering locations within the same metropolitan area, while Microsoft's newer resiliency guidance also describes standard, high-resiliency, and maximum-resiliency circuit designs. Business-critical environments should evaluate location diversity rather than assuming the two links of one circuit protect against an entire peering-location outage.

How does ExpressRoute pricing work?

ExpressRoute does not have one universal monthly price. Costs depend on the circuit bandwidth, peering zone, Local/Standard/Premium scope, metered or unlimited data plan, optional Global Reach, ExpressRoute gateway, and whether ExpressRoute Direct is used. Connectivity providers can also charge their own circuit or cross-connect fees outside Microsoft's Azure bill.

With the metered data plan, inbound data transfer is included while outbound transfer is billed by zone. The unlimited plan uses a higher fixed circuit fee that includes inbound and outbound transfer. ExpressRoute Direct adds monthly port-pair charges, and virtual network gateways are billed separately when required. Buyers should model the full path, including provider fees, Azure circuit fees, gateways, data transfer, redundancy, and any second circuit used for site diversity.

What reliability and performance limits should buyers understand?

ExpressRoute provides redundant links, but architecture determines the real failure domain. Microsoft currently recommends maximum-resiliency designs for critical production workloads because a single standard circuit at one peering location does not protect against a location-wide failure. Metro and multi-circuit designs add location diversity, while zone-redundant ExpressRoute gateways can improve gateway resilience inside Azure regions.

Bandwidth is fixed at the circuit level and can be increased when provider capacity is available, but Microsoft does not support an in-place bandwidth downgrade. Premium can expand route and connectivity limits, while ExpressRoute virtual network gateways have their own throughput and circuit-connection limits. Teams should also validate provider capacity, BGP routing design, route counts, gateway sizing, and failover behavior before treating ExpressRoute as the sole path for a critical workload.

How does ExpressRoute compare with Azure VPN Gateway?

Azure VPN Gateway uses encrypted tunnels over the public internet and is usually simpler and less expensive to start. ExpressRoute uses private connectivity through a provider or direct peering and is better suited to workloads that require more predictable latency, high sustained throughput, private routing, or larger hybrid-network designs.

Many enterprises use both. A site-to-site VPN can provide a backup path when ExpressRoute is unavailable, subject to the supported coexistence design and routing configuration. Organizations that only need occasional administration or low-volume hybrid traffic may be better served by VPN Gateway, while ExpressRoute is easier to justify when private connectivity and network performance are business requirements rather than preferences.

Who should choose something else?

Small teams with limited hybrid traffic, no colocation or provider relationship, and no strict private-connectivity requirement may find Azure VPN Gateway easier to deploy and operate. Internet-facing applications do not need ExpressRoute simply because they run in Azure, and private endpoints solve a different problem by giving individual Azure services private addresses inside a virtual network.

Organizations should also avoid buying ExpressRoute before they have a clear routing, redundancy, and cost model. The circuit adds provider coordination, BGP design, gateway planning, and recurring network cost. If a workload can tolerate internet-based encrypted connectivity, or if traffic is low and intermittent, the operational and financial overhead of ExpressRoute may outweigh its benefits.