The AZ-700 exam asks you to choose the right connection type, the right SKU, and the right redundancy strategy for VPN Gateway. The core scenario is always about bridging an on-premises network to Azure over the public internet using encrypted IPsec tunnels, but the scope also covers individual remote users connecting from home. Each SKU offers different throughput and tunnel counts, and authentication methods vary by scenario. Expect questions in the form of scenario → correct service selection.
What Is VPN Gateway
Imagine a private underground tunnel connecting a parking garage to the main office building. The tunnel runs beneath a public street, but everything inside is sealed and encrypted — no one outside can see what passes through. Azure VPN Gateway works exactly this way. It is a managed gateway service that connects an on-premises network to an Azure Virtual Network (VNet) through an IPsec/IKE encrypted tunnel over the public internet.
Because VPN Gateway encrypts all traffic with IPsec, organizations can meet compliance requirements for secure connectivity without paying for a dedicated private circuit like ExpressRoute. The gateway itself lives in a dedicated subnet called GatewaySubnet, and by default it deploys as two instances in an Active-Standby pair for basic redundancy.
Choosing the Right VPN Gateway SKU
Picking a VPN Gateway SKU is like choosing a cargo truck: you need to match payload capacity and number of lanes to your workload. The VpnGw1 through VpnGw5 series offers increasing throughput and tunnel counts, while the VpnGw1AZ through VpnGw5AZ series adds Availability Zone redundancy for zone-level fault isolation.
SKUs are further split into Generation1 and Generation2. Generation2 delivers higher throughput and more tunnels for the same tier. On the exam, a clue like "hundreds of S2S tunnels" points to VpnGw5, while "zone-redundant gateway" points to any AZ SKU. The Basic SKU is a legacy option that does not support BGP or IKEv2 and should never be used in new deployments.
Site-to-Site VPN: Connecting the Whole Office Network
Think of a logistics company that builds a dedicated freight lane between its headquarters warehouse and a regional depot. That lane handles all shipments between the two locations automatically. Site-to-Site (S2S) VPN does the same thing: it connects an entire on-premises network to an Azure VNet using an IPsec tunnel. On the on-premises side you need a compatible VPN device (a firewall or router); on the Azure side, a Local Network Gateway resource describes the on-premises public IP address and address prefixes.
The tunnel protocol is IKEv2 with IPsec. Enabling BGP lets the two sides exchange routing information dynamically, so adding a new on-premises subnet no longer requires a manual update to the Local Network Gateway. Choosing Active-Active mode gives the gateway two public IP addresses that handle traffic simultaneously, eliminating a single point of failure and reducing failover time compared to the default Active-Standby configuration.
!Site-to-Site versus Point-to-Site VPN
Point-to-Site VPN: A Personal Access Badge for Remote Workers
If a company issues access badges to employees, anyone with a valid badge can walk into the building from any location. Point-to-Site (P2S) VPN gives individual devices — a laptop, a smartphone — their own encrypted tunnel directly into an Azure VNet. Users install a VPN client and authenticate before the tunnel is established.
Three tunnel protocols are available:
OpenVPN (SSL/TLS over TCP 443): Supports Windows, macOS, Linux, Android, and iOS. Works through most firewalls. IKEv2: Optimized for macOS and Linux. Supports fast reconnect. SSTP (SSL over TCP 443): Windows only. Uses the built-in Windows VPN client.
Three authentication methods are also available. Certificate authentication distributes client certificates to each device. Microsoft Entra ID authentication integrates with Conditional Access and MFA, making it ideal for large-scale user management. RADIUS authentication connects to an existing Active Directory environment through a RADIUS server.
S2S vs P2S vs ExpressRoute at a Glance
Choosing between these three is like deciding whether to use a private toll road, a standard highway, or a dedicated freight rail line. Each has different speed, cost, and security characteristics.
| | S2S VPN | P2S VPN | ExpressRoute | |:--|:--|:--|:--| | Connects | Network to VNet | Device to VNet | Network to VNet | | Uses internet | Yes (IPsec) | Yes (IPsec/TLS) | No (private circuit) | | Max bandwidth | Up to 10 Gbps (SKU-dependent) | 100 Mbps to several Gbps | Up to 100 Gbps | | BGP support | Yes | No | Yes | | Primary use case | Hybrid connectivity, DR | Remote user access | Finance, regulated industries |
ExpressRoute bypasses the public internet entirely, offering predictable low latency and high bandwidth — but it requires a carrier contract and higher cost. VPN Gateway reuses existing internet connections.
Active-Active and BGP: Two Pillars of High Availability
A building with only one entrance is a single point of failure — block that door and nobody gets in. Active-Active VPN Gateway opens two entrances simultaneously. Both gateway instances each hold a public IP address and handle live traffic at the same time, so a failure in one instance does not disrupt connectivity.
BGP (Border Gateway Protocol) automates the exchange of routing information between the on-premises router and the VPN Gateway. Once BGP is enabled, new subnets on either side are advertised automatically without manual intervention. The combination of Active-Active mode and BGP is the recommended design for enterprise hybrid environments where downtime is not acceptable.
Exam Trap: Choosing the Right P2S Protocol
When a question mentions "remote access for users on Linux, macOS, and Windows," the answer is OpenVPN — the only protocol that supports all three platforms. SSTP only works on Windows, so it is wrong in any cross-platform scenario. "Authenticate P2S users with existing Active Directory accounts" points to RADIUS. "Integrate P2S with MFA and Conditional Access" points to Microsoft Entra ID authentication.
For S2S questions, "automatic route exchange and automatic failover" means BGP plus Active-Active. "Policy-based routing" is a legacy option for older on-premises VPN devices: it supports only a single tunnel and does not support BGP or IKEv2. "Route-based VPN" is the modern standard, supporting BGP, Active-Active, and IKEv2.
Exam Key Takeaways
"Connect entire on-premises network to Azure VNet over IPsec" -- Site-to-Site VPN "Individual laptops or phones connect to a VNet" -- Point-to-Site VPN "Zone-redundant VPN Gateway" -- VpnGw1AZ through VpnGw5AZ SKU "Large number of S2S tunnels, high throughput" -- VpnGw5 / Generation2 "P2S protocol that works on Linux, macOS, and Windows" -- OpenVPN "Windows-only P2S protocol" -- SSTP "P2S with MFA and Conditional Access" -- Microsoft Entra ID authentication "P2S authenticated by existing AD accounts" -- RADIUS "No single point of failure, two public IPs active simultaneously" -- Active-Active mode "Automatic route advertisement, no manual Local Network Gateway updates" -- BGP enabled "Legacy on-premises device compatibility, single tunnel, policy-based" -- Policy-based VPN "Private circuit, no public internet, low latency, high bandwidth" -- ExpressRoute (not VPN Gateway)
S2S = whole network connection, P2S = individual device connection, Active-Active + BGP = enterprise high-availability standard.