ExpressRoute
Azure ExpressRoute is a dedicated, private network connection between an on-premises datacenter and Azure that bypasses the public internet entirely, offering higher reliability, lower latency, and greater bandwidth than a site-to-site VPN. It's typically used by enterprises with strict compliance or performance requirements who need consistent, predictable connectivity to their Azure resources.
ExpressRoute
ExpressRoute is a private circuit provisioned through a connectivity provider — traffic never touches the public internet, which matters for both performance and compliance.
Why It Matters in Production
Zerodha connects its on-premises trading infrastructure to Azure via ExpressRoute for consistent sub-10ms latency and to keep sensitive trading data off the public internet entirely, a requirement under SEBI regulations.
az network express-route create --resource-group zerodha-prod-rg
--name zerodha-expressroute --peering-location "Mumbai"
--bandwidth 1000 --provider "Airtel" --sku-family MeteredData
TipExpressRoute doesn't encrypt traffic by default — layer IPsec on top if you're transmitting sensitive data and want encryption in addition to network isolation.
Frequently Asked Questions
How does ExpressRoute differ from a Site-to-Site VPN in terms of the path traffic takes?
A Site-to-Site VPN encrypts traffic and tunnels it over the public internet, so its latency and reliability depend on general internet routing and congestion. ExpressRoute instead uses a private, dedicated circuit through a connectivity provider, never touching the public internet, which gives it predictable latency, higher throughput (available up to 100 Gbps depending on peering location), and SLA-backed reliability that a VPN cannot guarantee.
When would a team choose VPN over ExpressRoute despite the reliability difference?
VPN is faster to provision (hours, via software configuration) and cheaper, making it the right default for smaller workloads, dev/test connectivity, or as a backup path. ExpressRoute requires provisioning through a connectivity partner, has longer lead times and higher fixed cost, so it's typically reserved for production workloads with strict compliance, consistent high-bandwidth data transfer, or regulatory requirements that explicitly disallow internet-routed traffic.