Can an Azure VNet reach Microsoft public services over ExpressRoute Microsoft peering?

Question

Can an Azure VNet reach Microsoft public services over ExpressRoute Microsoft peering?

Peter Stieber 90

Hi,

Can resources inside the VNet send traffic to Microsoft public services (e.g. Storage or Azure SQL public endpoints) over the ExpressRoute circuit using Microsoft peering, rather than via the default Internet system route?

From the docs, it looks like VNets connect to the circuit only through private peering, and Microsoft peering is documented as a path from on-premises to Microsoft public services. But I couldn't find an explicit statement on whether a VNet can consume Microsoft peering.

Is it correct that VNets cannot use Microsoft peering directly, and that Microsoft peering routes are not propagated to the VNet?

0 comments

Answer accepted by question author

Marcin Policht 109.9K MVP Volunteer Moderator

Yep - your understanding is correct - VNets cannot directly consume or route traffic through an ExpressRoute Microsoft peering path.

ExpressRoute supports two distinct peering types. Private Peering connects to IaaS and PaaS resources deployed inside or integrated with your VNets, while Microsoft Peering connects on-premises networks to Microsoft 365, Dynamics 365, and Azure public/PaaS services.

BGP routes learned through Microsoft Peering are advertised to your on-premises edge routers, not to Azure virtual network gateways or VNet route tables. An Azure VNet therefore has no mechanism to consume or insert Microsoft Peering routes.

By default, VNet traffic destined for Azure public endpoints, such as Azure Storage or Azure SQL, uses the built-in system route pointing to the Internet. If you want to keep traffic to Azure PaaS services off the public Internet, without sending it out to on-premises through Microsoft Peering, you should use Virtual Network Service Endpoints or Azure Private Link/Private Endpoints. Service Endpoints keep traffic on the Microsoft backbone, while Private Endpoints assign a private IP address from your VNet to the PaaS resource.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

0 comments

1 additional answer

Your answer

Answer 1

Hi @Peter Stieber

Yes, your understanding is correct.

ExpressRoute private peering and Microsoft peering are separate BGP routing domains. An Azure VNet connects to the circuit through an ExpressRoute virtual network gateway and Azure private peering. Microsoft documents private peering as the path used by Azure VNets and their private IP addresses.

Microsoft peering is established between the customer or connectivity-provider edge and Microsoft. It advertises the public prefixes for supported Microsoft services, but those routes aren’t propagated through the ExpressRoute gateway into the VNet’s route table.

An ExpressRoute circuit can’t operate as a transit router between its routing domains.

Therefore, a VNet resource can’t directly use Microsoft peering as the next hop for Azure Storage, Azure SQL, or other Microsoft public endpoints. It normally uses its configured public outbound path. If private connectivity is required, use a supported Private Endpoint so that the service is reached through a private IP address and ExpressRoute private peering.

Microsoft peering remains usable from the customer/provider edge, subject to its public-prefix advertisement and NAT requirements.

References:

ExpressRoute circuits and peerings

ExpressRoute routing requirements

ExpressRoute NAT requirements

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.