Skip to main content
Connecting an Azure Virtual Network (VNet) to an ExpressRoute circuit creates a private, high-throughput path between your on-premises environment and Azure. This guide walks through the portal-based steps to associate a VNet (via its Virtual Network Gateway) with an ExpressRoute circuit, plus verification and configuration notes.

​
Overview

  • Purpose: Enable private connectivity between on-premises networks and an Azure VNet over ExpressRoute.
  • Outcome: A connection resource that links an ExpressRoute circuit to a Virtual Network Gateway, shown on the circuit’s Connections blade.

​
Prerequisites

  • An existing ExpressRoute circuit.
  • A VNet with a Virtual Network Gateway configured to support ExpressRoute (not VPN-only).
  • Appropriate RBAC permissions on the circuit and gateway subscriptions.
  • If circuit and gateway are in different subscriptions, an authorization key may be required.
Steps
  1. Open the ExpressRoute circuit in the Azure portal.
    • From the circuit’s left-hand menu, select Connections.
    • Click Add at the top of the Connections page to create a new connection.
  2. Provide connection metadata on the Basics blade.
    • Subscription, resource group, and region are pre-populated when you start from the circuit.
    • Enter a Name for the connection — use a descriptive name to simplify later identification.
  3. Configure the connection settings.
    • Select the Virtual Network Gateway you want to link to the ExpressRoute circuit. This associates the chosen VNet with the circuit.
    • The Virtual Network Gateway must be ExpressRoute-capable; VPN-only gateways are not selectable.
    • The ExpressRoute circuit field should auto-populate since you started from the circuit.
Ensure the selected Virtual Network Gateway supports ExpressRoute (it must be an ExpressRoute-capable gateway, not a VPN-only gateway).
A screenshot of the Azure portal "Create connection" wizard for an ExpressRoute/VPN connection, showing the Basics tab with subscription, resource group and connection name fields. The right side shows the Settings tab with virtual network gateway and routing weight options.
Connection settings quick-reference
SettingPurposeNotes
NameIdentifies the connectionUse descriptive names (e.g., ER-VNet-Connection)
Virtual Network GatewayThe gateway resource to linkMust be ExpressRoute-capable
ExpressRoute circuitThe circuit to attachAuto-populates when created from the circuit
Routing weightPreference for routing when multiple paths existHigher weight is preferred
Authorization keyGrants cross-subscription cross-tenant associationRequired if resources live in different subscriptions/tenants
  1. Redeem authorization (only when required).
    • If the ExpressRoute circuit and the VNet (or its gateway) are in different subscriptions (or owned by different teams), obtain the authorization key from the circuit owner and redeem it during connection creation.
    • Optionally set the Routing weight to influence route selection — a higher routing weight makes this connection more preferred when multiple paths are available.
If the circuit and the gateway are in different subscriptions or owned by different teams, obtain and redeem the authorization key before creating the connection.
  1. Review and create.
    • Click Review + create to validate the configuration, then select Create to provision the connection.
    • Azure will create the connection object and attempt to establish the ExpressRoute association with the chosen Virtual Network Gateway.
  2. Verify the connection.
    • After provisioning, the connection appears on the circuit’s Connections page.
    • Status should show Succeeded and Type should indicate ExpressRoute.
    • The Peer column displays the name of the Virtual Network Gateway linked to the circuit.
    • If the status does not reach Succeeded, check gateway configuration, authorization keys, subscription permissions, and routing settings.
A screenshot of the Azure portal showing the TestERCircuit Connections page for an ExpressRoute circuit, listing a single connection "ER-VNet-Connection" with status "Succeeded" and peer "ERGW."
Troubleshooting tips
  • Confirm the gateway SKU supports ExpressRoute (check the gateway documentation for supported SKUs).
  • Verify RBAC roles across subscriptions if resources are owned by different teams.
  • Use the Azure portal notifications and the connection resource’s Diagnostics/Logs for provisioning errors.
Additional resources This process enables private, high-performance connectivity between your on-premises environment and your Azure Virtual Network via ExpressRoute. With that, this module is complete. Advanced features will be covered separately.

Watch Video