Azure Hybrid Connectivity: VPN Gateway, ExpressRoute, and Private Endpoints

Azure gives you four distinct ways to connect networks and resources privately: Azure VPN Gateway encrypts traffic between on-premises and Azure over the public internet, Azure ExpressRoute is a dedicated private circuit that avoids the internet entirely, virtual network (VNet) peering links two Azure VNets to each other over Microsoft’s backbone, and a private endpoint gives a single PaaS resource a private IP address inside a VNet. Each one solves a different connectivity problem, and the AZ-900 exam is largely a test of matching the right tool to the right requirement.

Azure VPN Gateway: encrypted connectivity over the internet

Azure VPN Gateway is a resource deployed inside a virtual network that terminates encrypted IPsec/IKE tunnels. It comes in a few connection flavors, and the exam expects you to tell them apart:

• Site-to-Site (S2S) links an entire on-premises network to an Azure VNet, so every device behind the on-premises firewall can reach Azure resources through the tunnel.
• Point-to-Site (P2S) connects a single client device — a remote employee’s laptop, for example — directly into the VNet without a site-wide tunnel.
• VNet-to-VNet uses gateways on both sides to connect two Azure virtual networks, an older pattern that VNet peering has mostly replaced for VNet-to-VNet scenarios.

Because it rides over the public internet, VPN Gateway is fast to provision and comparatively cheap, but its latency and throughput can be affected by internet congestion. Gateway SKUs differ in throughput ceiling and tunnel count, so a company connecting dozens of growing branch offices needs to size the SKU for that load rather than picking the cheapest one.

Azure ExpressRoute: a private, dedicated circuit

ExpressRoute extends your on-premises network into Azure through a dedicated connection provisioned by a connectivity provider — it never touches the public internet. That gives it more predictable latency, higher throughput, and a formal connectivity SLA, which is why it shows up in AZ-900 scenarios involving regulated industries, real-time transaction systems, or large continuous data transfers. The trade-off is cost and lead time: setting up a circuit takes longer and costs more than standing up a VPN Gateway tunnel — a cost worth weighing especially for organizations connecting facilities across multiple Azure regions and region pairs.

ExpressRoute circuits support two peering types, and a scenario asking for both Azure and Microsoft 365 access over the same circuit is really asking whether you know this split:

• Private peering connects the circuit to resources inside your Azure virtual networks.
• Microsoft peering connects the circuit to Microsoft 365 and Azure PaaS services that expose public endpoints, keeping that traffic off the internet too.

An organization that needs both reaches configures both peering types on one circuit — private peering alone leaves Microsoft 365 unreachable, and Microsoft peering alone leaves your VNets unreachable. ExpressRoute is also commonly paired with a VPN Gateway as an automatic, encrypted failover path — private and low-latency when the circuit is healthy, internet-based only if it fails.

VPN Gateway vs ExpressRoute

	Azure VPN Gateway	Azure ExpressRoute
Path	Encrypted tunnel over the public internet	Dedicated private circuit, no internet
Latency/throughput	Variable, subject to internet conditions	Predictable, higher throughput
Setup time and cost	Fast, lower cost	Slower, higher cost
SLA	Standard Azure resource SLA	Formal ExpressRoute connectivity SLA
Typical use	Branch offices, remote users, quick hybrid links	Regulated workloads, high-volume or latency-sensitive traffic

Connecting resources inside Azure: VNet peering

Virtual network peering links two Azure VNets so their resources talk to each other over Microsoft’s backbone network using private IP addresses — no gateway, no VPN tunnel, and no public internet path required. Global peering extends this across regions. Two details matter on the exam:

• Peering is non-transitive. If VNet A peers with VNet B, and VNet B separately peers with VNet C, A cannot reach C through B. A and C need their own direct peering (or another mechanism, such as a network virtual appliance) to communicate.
• Address spaces must not overlap. Azure rejects a peering request between VNets with conflicting IP ranges, so plan non-overlapping ranges before you expect to peer networks together.

Gateway transit lets a hub VNet share its VPN Gateway or ExpressRoute connection with peered spoke VNets, so spokes reach on-premises through the hub’s gateway instead of each spoke deploying its own — a common hub-and-spoke design pattern.

Private endpoints and service endpoints

A private endpoint is a network interface that receives a private IP address from your VNet’s own address space and attaches it to a specific PaaS resource, such as a storage account or an Azure SQL Database. Once configured, that resource is reachable at a private address inside your network, and its public endpoint is no longer the only path in — private endpoints eliminate reliance on the public endpoint for traffic originating in the VNet.

A service endpoint is a lighter-weight alternative: the PaaS resource keeps its public IP address, but the endpoint optimizes routing over the Azure backbone and restricts access to specific subnets. The resource is still technically public, just filtered — that distinction is exactly what the exam probes when it asks you to choose between the two.

One more connectivity pattern worth knowing: for administrative access — RDP or SSH into a VM — without exposing any inbound ports or requiring a VPN client at all, Azure Bastion provides a fully managed, browser-based session broker through the Azure portal. It solves a narrower problem than VPN Gateway or ExpressRoute (remote management sessions, not general network connectivity), but the exam sometimes places it in the same answer list to see if you’ll confuse “connect a network” with “connect an administrator to one VM.” Bastion’s no-inbound-ports model is one piece of the layered approach detailed in Zero Trust, Defense in Depth, and Microsoft Defender for Cloud. For the subnet design and DNS resolution that these connectivity options sit on top of, see Azure Virtual Networks, Subnets, and DNS Fundamentals.

How the AZ-900 exam tests this

• Trade-off scenarios pick VPN Gateway or ExpressRoute based on stated priorities. If the stem emphasizes avoiding the public internet, needing predictable low latency, or accepting a longer setup process, the answer is ExpressRoute. If it emphasizes low cost, fast provisioning, and accepting an internet-based path, the answer is VPN Gateway.
• “Private IP inside the VNet, no public exposure” always points to a private endpoint, not a service endpoint, not ExpressRoute, and not VNet peering — those solve different problems (public-endpoint filtering, on-premises connectivity, and VNet-to-VNet communication, respectively).
• Peering chains test the non-transitive rule. A question describing A-to-B and B-to-C peering, then asking why A can’t reach C, is testing whether you know peering doesn’t automatically extend across a chain.
• Combined-requirement scenarios reward knowing you can layer services. A prompt describing a company that needs private low-latency Azure access, Microsoft 365 access, and an automatic encrypted fallback usually wants ExpressRoute with both peering types plus a VPN Gateway backup — not a single service doing everything.

Once you can recognize which requirement points to which service, the connectivity domain on AZ-900 becomes pattern matching rather than memorization. If you want to see how these scenarios are actually phrased on the exam, work through AZ-900 practice questions that mix VPN Gateway, ExpressRoute, peering, and private endpoint scenarios together, since the real skill being tested is telling them apart under exam pressure. For the storage side of private connectivity — which account types and services a private endpoint most often protects — see Azure Storage Services and Account Types Explained.

Quick reference

• Azure VPN Gateway: encrypted tunnel over the public internet; Site-to-Site (network-to-network), Point-to-Site (device-to-network), or VNet-to-VNet.
• Azure ExpressRoute: private, dedicated circuit that never touches the internet; higher cost and longer lead time in exchange for predictable performance and an SLA.
• ExpressRoute private peering reaches your VNets; Microsoft peering reaches Microsoft 365 and Azure PaaS public endpoints — configure both if you need both.
• VNet peering connects two Azure VNets privately over the Microsoft backbone; it is non-transitive and requires non-overlapping address spaces.
• Gateway transit lets peered spoke VNets reuse a hub VNet’s VPN Gateway or ExpressRoute connection.
• A private endpoint gives a PaaS resource a private IP inside your VNet; a service endpoint keeps the resource’s public IP but restricts and optimizes access from specific subnets.
• ExpressRoute plus a VPN Gateway backup is the standard pattern for private primary connectivity with automatic encrypted failover.