Azure ExpressRoute Complete Guide: Design, Deploy & Operate Private Connectivity

Azure ExpressRoute connects an enterprise on-premises network to Azure over a private dedicated circuit, delivering enterprise-grade SLA, bandwidth, and latency. It is one of the foundational connectivity services in Azure. This article organizes ExpressRoute's components, SKU selection, encryption options, deployment process, and cost structure into a comprehensive reference designers can apply directly to real projects.

ExpressRoute vs VPN Gateway

The Circuit / Connection Hierarchy

ExpressRoute uses a three-tier structure: Circuit → Peering → Connection.

• Circuit: the Azure resource that represents the physical line you contract with a carrier. Holds the service provider, bandwidth, SKU, and billing type.
• Peering: a routing domain inside a Circuit. Two types — Private Peering (for VNet connectivity) and Microsoft Peering (for Microsoft 365 / Azure PaaS).
• Connection: the resource that links a Circuit to a VNet. One Circuit can host multiple Connections (multiple VNets).

Standard SKU supports up to 10 Connections per Circuit; Premium SKU supports up to 100.

SKU Selection: Local / Standard / Premium

For Japan-only workloads, Standard is sufficient; global enterprises or disaster-recovery setups that require cross-region connectivity need Premium.

Global Reach

Global Reach is a feature that interconnects two ExpressRoute Circuits over the Microsoft backbone.

Example: connect a Tokyo office to Tokyo Azure via one ExpressRoute, connect a London office to London Azure via another, then link the two with Global Reach — and the Tokyo and London offices can communicate at high speed over the Microsoft backbone. This replaces traditional inter-site carrier circuits (such as site-to-site IP-VPN) by using the Microsoft backbone as your WAN. It requires Premium SKU plus Global Reach billing (tens of thousands of yen per month) and is gaining attention as a global WAN cost-reduction solution for multi-site enterprises.

ExpressRoute Direct

Regular ExpressRoute connects to Microsoft Edge via a service provider (NTT Communications, SoftBank, KDDI, Equinix, Megaport, etc.) over a carrier line. ExpressRoute Direct lets customers purchase Microsoft Edge router ports (10 Gbps or 100 Gbps) directly and connect to Microsoft using their own private circuits.

By bypassing service providers, it delivers ultra-high capacity (100 Gbps × 2 = 200 Gbps) and Layer 2 access. Pricing is steep (millions to over 10 million yen per month), so it is reserved for ultra-large enterprises (core systems at financial institutions and major SIs) or used by service providers themselves. MACsec encryption is available only with ExpressRoute Direct.

Encryption Options

ExpressRoute is not encrypted by default. Traditionally, the view was that since the circuit is physically isolated, encryption was unnecessary — but modern zero-trust approaches recommend adding encryption.

• MACsec (Media Access Control Security): ExpressRoute Direct only, L2-layer encryption with AES-128-GCM / AES-256-GCM.
• IPsec over ExpressRoute: layer a VPN Gateway over ExpressRoute and run an IPsec tunnel on top of ExpressRoute Private Peering. The most common end-to-end encryption pattern.
• Customer-managed encryption: encrypt at the application layer (HTTPS / TLS).

When compliance requirements (GDPR, HIPAA, PCI DSS) mandate end-to-end encryption, IPsec over ExpressRoute is the go-to pattern.

Deployment Process

Here are the standard deployment steps. End to end, the process takes 2-4 months.

1. Select a service provider (NTT Com, SoftBank, KDDI, Equinix, Megaport, etc. — choose the peering location geographically closest to your Azure region)
2. Sign the carrier circuit contract with the service provider (lead time 4-12 weeks — the biggest bottleneck)
3. Create the ExpressRoute Circuit resource in the Azure Portal (which issues a Service Key)
4. Hand the Service Key to the service provider to activate the circuit
5. Configure the Circuit's peerings (Private Peering for VNet connectivity, Microsoft Peering for M365 / Azure PaaS)
6. Deploy an ExpressRoute Gateway into the GatewaySubnet of your hub VNet
7. Connect the Circuit and Gateway with a Connection
8. Verify routing behavior and run failover tests

Cost Structure

ExpressRoute cost breaks down into the following components (reference: 1 Circuit, 1 Gbps, Standard SKU, Tokyo region).

High Availability (HA) Design

High-availability design for ExpressRoute is mandatory in production environments.

• Dual Circuit: provision two Circuits through different service providers so traffic continues on one if the other fails.
• Geo-Redundant Pair: provision two Circuits in different regions (e.g., Tokyo + Osaka) for geographic redundancy.
• VPN Failover: ExpressRoute as primary plus VPN Gateway as backup. A cost-efficient HA pattern.
• BGP metric tuning: control route preference with AS Path Prepending and Local Preference.

Related Certifications

Microsoft certifications are the most efficient way to systematically build ExpressRoute knowledge.

• AZ-700 (Network Engineer Associate): covers ExpressRoute deeply, with frequent design-decision questions on Peering, routing, Connections, SKU selection, FastPath, and more.
• AZ-104 (Administrator): ExpressRoute fundamentals in Domain 4.
• AZ-305 (Solutions Architect Expert): architectural selection (VPN vs ExpressRoute vs Virtual WAN).

See Azure Network Engineer Career Roadmap for details.

Frequently Asked Questions

Technical information in this article is based on the Azure ExpressRoute Documentation. This article is not an official Microsoft Corporation product and is not affiliated with or sponsored by Microsoft. Microsoft and Azure are trademarks of the Microsoft group of companies. Information is based on official materials published as of May 24, 2026. Always check the official pages for the latest information.