VPN Gateway provides encrypted IPsec connectivity over the internet. ExpressRoute provides private connectivity through a provider/exchange, but private routing is not automatically end-to-end encryption. Azure Arc projects non-Azure servers, Kubernetes, and selected data services into Azure management so policy, inventory, security, and operations can span hybrid environments.
Many enterprises use ExpressRoute primary plus site-to-site VPN backup, but route preference and failover must be tested.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Create GatewaySubnet, then a Virtual network gateway, a Local network gateway representing on-premises prefixes/device, and finally a Connection with reviewed IPsec parameters. Use a strong shared secret delivered through an approved secret process, not chat or source control.
CLI resource creation spans az network vnet-gateway, local-gateway, and vpn-connection, but a reviewed IaC module is safer than an improvised command chain for this slow, billable deployment.
Create an ExpressRoute circuit in Azure, provide its service key to the selected connectivity provider, configure peering/BGP, link the circuit to a virtual network gateway or Virtual WAN hub, validate routes, and test redundancy. Service keys and circuit details are sensitive operational information.
Microsoft peering and private peering have different purposes and controls. Route filters, Global Reach, FastPath, encryption options, and gateway SKUs require current product/provider validation.
Arc-enabled servers install a connected machine agent and appear as Azure resources. Arc-enabled Kubernetes connects clusters for inventory, policy, GitOps, Defender, and monitoring. Arc does not move the workload into Azure; availability still depends on the original environment and connectivity.
Use an at-scale onboarding method with a least-privilege identity. Review the onboarding script before execution. Scope network destinations, private link where required, extension allowlists, policy, update management, Defender, and data collection.
Keep separate trust zones. Use Entra/managed identity integrations where supported, certificate lifecycle, privileged access workstations, and centralized logging. Do not give the Arc agent or hybrid automation broad local administrator rights beyond the documented requirement.
For Kubernetes, workload identity differs across providers; do not assume AKS-managed identity behavior applies to every Arc-connected cluster.