This chapter covers Azure VPN Gateway and Azure ExpressRoute — two ways to connect on-premises networks to Azure. AZ-900 tests this under objective 2.3, as part of describing Azure networking services.
Jump to a section
A simple way to picture Azure VPN Gateway and ExpressRoute
Imagine two ways to connect a company's office to a remote warehouse. One option is a secure, encrypted tunnel that runs through the regular public road system — reliable and much cheaper to set up, but still sharing the underlying roads with everyone else, even though the tunnel itself is private. The other option is a dedicated private road built directly between the two locations, bypassing the public roads entirely — more consistent and often faster, but more expensive and involved to establish. Azure VPN Gateway is like the encrypted tunnel through public roads (using the internet, encrypted for privacy); Azure ExpressRoute is like the dedicated private road (a direct, private connection that doesn't traverse the public internet at all).
Azure VPN Gateway
Azure VPN Gateway creates an encrypted connection between an on-premises network (or an individual device) and an Azure Virtual Network, using the public internet as the underlying transport but encrypting the traffic so it remains private. It's a relatively quick and cost-effective way to establish connectivity between on-premises infrastructure and Azure.
Azure ExpressRoute
Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, that doesn't travel over the public internet at all. This generally offers more consistent performance and can meet requirements where organizations don't want their traffic to traverse the public internet, even in encrypted form — but it requires more setup and is a more involved, dedicated connection to establish.
How they compare
VPN Gateway is generally faster and simpler to set up, using existing internet connectivity, making it a common choice for smaller-scale or less performance-sensitive connections. ExpressRoute offers a private, dedicated connection with generally more consistent performance, suited to larger organizations or workloads with stricter connectivity requirements — at the cost of more setup complexity.
Why hybrid connectivity matters
Many organizations don't move everything to the cloud at once — they maintain some on-premises infrastructure while extending into Azure. VPN Gateway and ExpressRoute are the two primary ways Azure supports connecting those on-premises environments securely to Azure resources.
Assess connectivity requirements
Consider whether the organization needs a quick, cost-effective connection (favoring VPN Gateway) or requires a private, dedicated connection with more consistent performance (favoring ExpressRoute).
Set up VPN Gateway for simpler needs
VPN Gateway is configured to create an encrypted connection over the internet between the on-premises network and an Azure Virtual Network.
Set up ExpressRoute for dedicated needs
ExpressRoute involves working with a connectivity provider to establish a private, dedicated connection that doesn't use the public internet.
Connect on-premises resources securely to Azure
Once established, either connection lets on-premises resources communicate with Azure resources as if they were part of the same private network.
A small business extending some workloads into Azure while keeping a modest on-premises presence uses VPN Gateway, since it's quicker and less expensive to set up for their relatively lower-traffic connectivity needs.
A large enterprise with strict performance and consistency requirements for its hybrid infrastructure uses ExpressRoute instead, since the dedicated, private connection avoids the variability of the public internet and better suits their scale and requirements — accepting the additional setup involved for that benefit.
Objective 2.3 expects candidates to distinguish between VPN Gateway (encrypted connection over the public internet) and ExpressRoute (private, dedicated connection not using the public internet).
A common wrong answer is assuming both options work the same way, just with different pricing — they use fundamentally different underlying connectivity (public internet vs. dedicated private connection). Another common trap is assuming ExpressRoute is always the "better" choice — it's more suited to specific needs around performance consistency and avoiding the public internet, not universally superior for every scenario.
Stable terms: VPN Gateway, ExpressRoute. Knowing that VPN Gateway uses the internet (encrypted) while ExpressRoute uses a private, dedicated connection is the single most important distinction for this topic.
Memory trick: VPN Gateway = encrypted tunnel over the public internet. ExpressRoute = private, dedicated connection that skips the public internet entirely.
Azure VPN Gateway creates an encrypted connection between on-premises networks and Azure over the public internet.
Azure ExpressRoute provides a private, dedicated connection between on-premises networks and Azure, not using the public internet.
VPN Gateway is generally quicker and less costly; ExpressRoute generally offers more consistent performance for stricter needs.
Both are approaches to hybrid connectivity — connecting on-premises infrastructure securely to Azure resources.
These come up on the exam all the time. Here's how to tell them apart.
Azure VPN Gateway
Encrypted connection over the public internet
Generally quicker and less costly to set up
Suited to smaller-scale or less performance-sensitive needs
Azure ExpressRoute
Private, dedicated connection, not using the public internet
Generally more consistent performance
Suited to larger-scale or stricter connectivity requirements
Mistake
VPN Gateway and ExpressRoute both use the public internet, just with different security.
Correct
VPN Gateway uses the public internet with encryption. ExpressRoute uses a private, dedicated connection that doesn't traverse the public internet at all — a fundamentally different underlying connection type.
Mistake
ExpressRoute is always the better choice.
Correct
ExpressRoute suits specific needs around performance consistency and avoiding the public internet, but requires more setup and cost. VPN Gateway is often a perfectly appropriate, simpler choice for smaller-scale needs.
Mistake
You need both VPN Gateway and ExpressRoute for hybrid connectivity.
Correct
They're alternative approaches to the same general problem — an organization typically chooses one based on its specific needs, rather than requiring both.
VPN Gateway creates an encrypted connection over the public internet between on-premises networks and Azure. ExpressRoute provides a private, dedicated connection that doesn't use the public internet at all, generally offering more consistent performance at the cost of more setup complexity.
It depends on their needs — VPN Gateway is quicker and less costly, suiting smaller-scale or less performance-sensitive connections. ExpressRoute suits organizations with stricter performance or connectivity requirements, willing to invest in a more dedicated setup.
No — they're used for hybrid connectivity, letting an organization keep some infrastructure on-premises while securely connecting it to resources running in Azure, rather than requiring a full migration away from on-premises infrastructure.
You've just covered Azure VPN Gateway and ExpressRoute — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?