Your datacentre needs to talk to your Azure virtual networks. Azure gives you two main ways to do it: Azure VPN Gateway or ExpressRoute. The difference is the path your traffic takes.
The one-sentence difference
- A VPN gateway sends encrypted traffic over the public internet.
- ExpressRoute sends traffic over a private connection through a connectivity provider. It doesn’t go over the internet, and it isn’t encrypted by default.
VPN Gateway: encrypted, over the internet
- Site-to-site (S2S): an IPsec/IKE tunnel between the Azure VPN gateway and your on-premises VPN device.
- Point-to-site (P2S): individual devices connect using OpenVPN, IKEv2 or SSTP, for people working from home or travelling.
It’s the cheaper, quicker option: Learn puts gateway provisioning at about 45 minutes.
ExpressRoute: private, through a provider
An ExpressRoute circuit connects you to Microsoft at a peering location, with two connections to two Microsoft edge routers for built-in redundancy and BGP for routing. A circuit has two peerings:
- Private peering: reaches your virtual networks on their private IP addresses.
- Microsoft peering: reaches Microsoft 365 and Azure PaaS services over public IP addresses that you or your provider own.
Getting a circuit takes weeks to months, because the provider has to provision physical infrastructure.
Encryption options
Because ExpressRoute isn’t encrypted by default, Learn lists two add-ons:
- MACsec (layer 2) encrypts the physical links between your routers and Microsoft’s. It’s available only on ExpressRoute Direct, is off by default, and you bring your own key, stored in Azure Key Vault.
- IPsec (layer 3) gives end-to-end encryption: run a site-to-site VPN over private peering to an Azure VPN gateway (or through Virtual WAN). You can use it alongside MACsec.
Global Reach and FastPath
- ExpressRoute Global Reach links two of your circuits so your on-premises sites can talk to each other across Microsoft’s network. Circuits in different geopolitical regions must be Premium.
- FastPath sends traffic straight to the VMs, bypassing the ExpressRoute gateway for lower latency and higher throughput. You still need the gateway to exchange routes, and it must be Ultra Performance, ErGw3Az or ErGwScale with at least 10 scale units.
Bandwidth and SLA
| Path |
Public internet, IPsec |
Private, via provider |
| Encrypted by default |
Yes |
No |
| Bandwidth |
Up to 10 Gbps aggregate (VpnGw5AZ); one tunnel is much lower |
Provider circuits 50 Mbps to 10 Gbps; Direct ports of 10, 100 or 400 Gbps |
| Latency |
Variable (internet) |
Low and predictable |
| SLA |
99.95% for every SKU except Basic |
Depends on design: single site, Metro or multiple peering locations |
| Set-up time |
Hours to days |
Weeks to months |
For maximum ExpressRoute resiliency, Microsoft recommends two circuits in two peering locations.
Gateway SKUs, as Learn states them now
- New VPN gateways use the AZ SKUs: VpnGw1AZ to VpnGw5AZ. Since 1 November 2025 you haven’t been able to create the non-zone SKUs (VpnGw1 to VpnGw5). The migration window ran from September 2025 to September 2026, and the old SKUs are scheduled for deprecation after September 2026.
- Basic isn’t retiring, but it’s for dev/test only: no BGP, no IKEv2 for P2S, no RADIUS, no IPv6, and it can’t coexist with ExpressRoute. A new gateway of any SKU needs a Standard public IP address.
- ExpressRoute gateways are a separate family: ErGw1Az, ErGw2Az, ErGw3Az and ErGwScale, alongside the older Standard, HighPerformance and UltraPerformance.
VPN as a backup for ExpressRoute
The two can coexist in one virtual network, so a site-to-site VPN can act as a secure failover path for ExpressRoute, or connect branch sites that have no circuit. The rules:
- The VPN gateway must be route-based and not Basic.
- The GatewaySubnet must be /27 or larger.
- ExpressRoute is always the primary path; set a higher local preference on-premises for routes learned over ExpressRoute to avoid asymmetric routing.
Many sites? Consider Virtual WAN
Virtual WAN puts S2S VPN, P2S, ExpressRoute and SD-WAN partner devices into Microsoft-managed hubs, with transit between VPN and ExpressRoute sites. Learn’s SKU page says that if you need more than 100 site-to-site tunnels, use Virtual WAN instead of VPN Gateway. A Basic virtual WAN does site-to-site VPN only; ExpressRoute needs Standard.
Three exam traps
- “Private” doesn’t mean “encrypted”. ExpressRoute traffic isn’t encrypted by default. MACsec needs ExpressRoute Direct; on a provider circuit, the answer is IPsec over private peering.
- VPN failover covers private peering only. There’s no VPN-based failover for services reached over Microsoft peering, and the backup VPN gateway can’t be Basic.
- Global Reach joins your sites, not your VNets, and it isn’t transitive. Linking circuit A to B and B to C doesn’t connect A to C; you link each pair yourself, and the two circuits must be at different peering locations.
Pick it in five seconds
| Encrypted link on a budget, up and running today |
Site-to-site VPN |
| Individual remote users into a VNet |
Point-to-site VPN |
| Private, predictable, high-bandwidth, no internet path |
ExpressRoute (private peering) |
| Microsoft 365 or PaaS over ExpressRoute |
Microsoft peering |
| Encryption on ExpressRoute |
MACsec (Direct) or IPsec over private peering |
| Two on-premises sites linked through Microsoft’s network |
Global Reach |
| A cheap safety net if the circuit fails |
Coexisting site-to-site VPN |
| Dozens of branches, or more than 100 tunnels |
Virtual WAN |
Go deeper
Hybrid connectivity is covered in the AZ-700 study guide, the AZ-104 study guide the AZ-305 study guide and, for the basics, the AZ-900 study guide, with the traps called out like these. Facts checked against Microsoft Learn on 8 October 2026.
