Azure AI Engineer

Azure Administrator

Azure Solutions Architect Expert

Azure Fundamentals

Azure Security Engineer

Azure Network Engineer Associate

<p>Start writing your course overview...</p>

Learn the fundamentals of what you need to know for the AZ-104 networking questions during your exam.

AZ-104 Networking Crash Course

IP Addresses

Network Address Space & Subnets

Route Tables and User Defined Routes (UDRs)

Network Security Groups (NSGs)

Application Security Groups (ASGs)

Peering

Azure VPN Gateway

Azure ExpressRoute

Azure Load Balancer

Azure Application Gateway

<h2>What is ExpressRoute?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-8/001-intro-expressroute.png" alt="ExpressRoute Intro"><p>Azure ExpressRoute is a service that allows you to extend your on-premises infrastructure into Azure using a <strong>dedicated private</strong> <strong>connection</strong> provided by an approved ExpressRoute “connectivity provider”.</p><p>Unlike Azure VPN Gateway, which uses encrypted tunnels over the public internet, ExpressRoute traffic <strong>never goes through the public internet</strong>.</p><p>It’s one of the main services used for <strong>enterprise hybrid connectivity</strong>, in order to improve reliability, performance, and security between an on-premises environment and Azure.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If an exam question mentions keywords such as “high bandwidth”, “predictable latency”, or “avoiding the internet entirely”, &lt;strong&gt;choose ExpressRoute&lt;/strong&gt;. If it’s about connecting remote users or having “flexible connections”, choose VPN Gateway.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If an exam question mentions keywords such as “high bandwidth”, “predictable latency”, or “avoiding the internet entirely”, &lt;strong&gt;choose ExpressRoute&lt;/strong&gt;. If it’s about connecting remote users or having “flexible connections”, choose VPN Gateway.&lt;/p&gt;</div></div><h2>Peering options</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-8/002-private-peering-vs-microsoft-peering.png" alt="Peering options comparison"><p>ExpressRoute supports two main types of peering, which determine what destinations are reachable from your on-premises network.</p><p><strong>Azure Private Peering</strong> is used to connect your on-premises environment to an Azure Virtual Network, so that it can access things like VMs, Storage Accounts and databases.</p><p><strong>Microsoft Peering</strong> is used to connect your on-premises environment to a Microsoft SaaS service, such as Microsoft 365 or Dynamics 365.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If an exam question includes the option “Public Peering”, &lt;strong&gt;it’s a trap&lt;/strong&gt;. Public Peering is a type of peering option for ExpressRoute that has been discontinued and is no longer available.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If an exam question includes the option “Public Peering”, &lt;strong&gt;it’s a trap&lt;/strong&gt;. Public Peering is a type of peering option for ExpressRoute that has been discontinued and is no longer available.&lt;/p&gt;</div></div><h2>How to set up ExpressRoute</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-8/003-deploy-expressroute.png" alt="Setup ExpressRoute"><p>To set up an ExpressRoute connection for your company, begin by ordering an <strong>ExpressRoute circuit</strong> from an approved connectivity provider or by arranging a direction connection at a peering location.</p><p>Once the circuit is ready, link it to your Azure Subscription so that it can be associated with your Azure resources.</p><p>Next, you need to create an <strong>ExpressRoute Gateway</strong> within your Azure Virtual Network. This gateway must be deployed in a dedicated subnet named <strong>GatewaySubnet</strong>.</p><p>After the gateway is in place, you need to configure routing by establishing <strong>BGP sessions</strong> between your on-premises routers and the Microsoft edge routers.</p><p>With routing established, your on-premises traffic will flow over the private dedicated ExpressRoute connection into Azure (and vice-versa).</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If you encounter a question asking how to configure ExpressRoute, make sure to include the option that mentions “Create a subnet named &lt;strong&gt;GatewaySubnet &lt;/strong&gt;within the Virtual Network”.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If you encounter a question asking how to configure ExpressRoute, make sure to include the option that mentions “Create a subnet named &lt;strong&gt;GatewaySubnet &lt;/strong&gt;within the Virtual Network”.&lt;/p&gt;</div></div><h2>How is ExpressRoute different from VPN Gateway?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-8/004-expressroute-vs-vpn-gateway.png" alt="ExpressRoute vs VPN Gateway"><p>In Azure networking, both ExpressRoute and VPN Gateway are methods of connecting your on-premises network to your Azure Virtual Networks.</p><p>You will encounter both services in the AZ-104 exam, often in questions about hybrid connectivity or network design, so it’s essential to understand their differences.</p><p>The table below summarizes the key differences between them.</p><table class="tiptap-table" style="min-width: 300px;"><colgroup><col style="min-width: 100px;"><col style="min-width: 100px;"><col style="min-width: 100px;"></colgroup><tbody><tr class="tiptap-table-row"><th class="tiptap-table-header" colspan="1" rowspan="1"><p>Feature</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>ExpressRoute</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>VPN Gateway</p></th></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Network Transport</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Microsoft backbone network</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Public Internet (through an encrypted tunnel)</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Performance</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>High bandwidth, low latency</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Depends on internet speed and quality</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Security</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Private transport, but not encrypted</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Public transport, but encrypted (IPsec)</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Requires a network provider?</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Yes, a third-party connectivity provider</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>No, works out of the box</p></td></tr></tbody></table><p>In short, ExpressRoute is used for enterprise-scale and mission-critical workloads that require predictable performance, while VPN Gateway is used in small to medium organizations that don’t require mission-critical connectivity.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If you encounter a question which requires that network traffic going to Azure from on-premises “&lt;strong&gt;must not traverse the public internet&lt;/strong&gt;” in order to meet &lt;strong&gt;strict compliance&lt;/strong&gt;, then choose ExpressRoute as the answer.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If you encounter a question which requires that network traffic going to Azure from on-premises “&lt;strong&gt;must not traverse the public internet&lt;/strong&gt;” in order to meet &lt;strong&gt;strict compliance&lt;/strong&gt;, then choose ExpressRoute as the answer.&lt;/p&gt;</div></div><h2>What to remember for your exam</h2><ul><li><p>ExpressRoute is used to establish a dedicated private connection from your on-premises environment to Azure.</p></li><li><p>It supports two types of peering: Azure Private Peering and Microsoft Peering.</p></li><li><p>ExpressRoute is always deployed into a subnet named GatewaySubnet.</p></li><li><p>Network traffic goes through the Microsoft backbone network, not the public internet.</p></li><li><p>ExpressRoute has high bandwidth and low latency. Choose it when compliance and performance are your top priorities.</p></li></ul><h2>What’s next?</h2><p>To lock in what you’ve learned, take the short <strong>8-question quiz</strong> for this lesson. It will help you test your understanding of <strong>Azure ExpressRoute</strong> before you move on.</p><p>In the next lesson, you will learn how to <strong>distribute network traffic</strong> evenly to multiple Virtual Machines using <strong>Azure Load Balancer</strong>.</p><p></p>

Azure ExpressRoute

Alexandru Tepes

Practice Quiz

Want to pass your next certification?

Azure AI Engineer

Azure Administrator

Azure Solutions Architect

Azure Fundamentals

Azure Security Engineer

Azure Network Engineer

Want to connect with others?

Join Our Discord Community

Active Discussions

Study Groups

Celebrate Wins