Design, Implement and Manage Connectivity Services
VPN Gateway
VPN Gateway provides IPsec/IKE tunnels over the internet. Use route-based gateways (policy-based only exists in legacy Basic SKUs). Sizes run VpnGw1–VpnGw5 with AZ variants, and throughput, tunnel count and P2S connections scale with SKU. Point-to-site supports certificate, RADIUS and Microsoft Entra ID authentication, with IKEv2, SSTP and OpenVPN tunnel types. Active-active mode requires two public IP addresses and two gateway instances; BGP enables dynamic route exchange with on-premises devices. The Basic SKU lacks BGP, active-active, ExpressRoute coexistence and zone redundancy, so it is almost never the correct answer in a design question.
ExpressRoute
ExpressRoute is a private circuit through a connectivity provider, offering private peering (VNets), Microsoft peering (Microsoft 365 and public Azure services) and, with ExpressRoute Direct, MACsec encryption. BGP is mandatory. ExpressRoute itself does not encrypt customer traffic - if confidentiality is required, layer a site-to-site VPN over the circuit or use MACsec. Gateway SKUs (Standard, HighPerformance, UltraPerformance, ErGw1/2/3Az) cap throughput, and FastPath bypasses the virtual network gateway for the data path.
Coexistence and Virtual WAN
ExpressRoute plus a VPN gateway in the same GatewaySubnet gives a failover design; both need a non-Basic SKU and correct BGP AS numbers. Virtual WAN provides Microsoft-managed hubs, any-to-any transit, and secured hubs with Azure Firewall or a partner NVA - the right choice for many branches with minimal operations.
Rule of thumb: encrypted, quick to deploy, modest bandwidth → VPN. Deterministic, private, high bandwidth with SLA → ExpressRoute. Many sites needing global transit → Virtual WAN.