Azure ExpressRoute limits for large organizations & resellers… What are my boundaries?

The Theory
Let’s start off with some statements from the ExpressRoute FAQ

  • Can I have more than one ExpressRoute circuit in my subscription? Yes. You can have more than one ExpressRoute circuit in your subscription. The default limit on the number of dedicated circuits is set to 10. You can contact Microsoft Support to increase the limit if needed.
  • Can I have ExpressRoute circuits from different service providers? Yes. You can have ExpressRoute circuits with many service providers. Each ExpressRoute circuit will be associated with one service provider only.
  • Can I link to more than one virtual network to an ExpressRoute circuit? Yes. You can link up to 10 virtual networks to an ExpressRoute circuit.
  • I have multiple Azure subscriptions that contain virtual networks. Can I connect virtual networks that are in separate subscriptions to a single ExpressRoute circuit? Yes. You can authorize up to 10 other Azure subscriptions to use a single ExpressRoute circuit. This limit can be increased by enabling the ExpressRoute premium feature.
  • Can I have one virtual network connected to more than one ExpressRoute circuit? Yes. You can link a single virtual network with up to 4 ExpressRoute circuits. All ExpressRoute circuits must be in the same continent. They can be ordered through different service providers and in different locations.

And then we’ll check the Azure Limits page…

  • ExpressRoute dedicated circuits per subscription : 10 (default) & 25 (max)

The Summary

  • So per subscription, you can add up to 25 ExpressRoute circuits. These can be a mix of EXP or NSP connection and can be purchased from different telecom providers.
  • By default you can split up your ExpressRoute circuit between 10 VNETs (which can be located in different Subscriptions). It is possible to exceed that limit, where the maximum depends on your Azure port speed. A maximum of 100 VNETs can be configured when using a 10Gbit connection in EXP mode.

The Code

Grant a part of the circruit to “salesadmin@contoso.com” (as “masterofthenuniverse@contoso.com”)

New-AzureDedicatedCircuitLinkAuthorization -ServiceKey ‘6ed7e310-1a02-4261-915f-6ccfedc416f1’ -Description ‘SalesTeam’ -Limit 2 -MicrosoftIds ‘salesadmin@contoso.com’

Link the newly granted circuit to your VNET (as salesadmin@contoso.com)

New-AzureDedicatedCircuitLink –servicekey (Get-AzureAuthorizedDedicatedCircuit).CircuitName –VnetName ‘SalesVNET1’

Source : Sharing an ExpressRoute circuit across multiple subscriptions

In need of private network connectivity for Office 365 & Azure Services?

You are looking to use Office 365 or Azure Services, though you are wondering how you can seggregate workloads from travelling over public networks… With ExpressRoute, you are able to ensure that certain services are only accessible via your private virtual networks!

expressroute-public-and-private-peering

This possibility is possible for all Azure Services, except the following ;

  • Content Delivery Network
  • Visual Studio Online Load Testing
  • Multi-factor Authentication

So connectivity to virtual machines and cloud services deployed in virtual networks are supported over the private peering path. The same goes for Azure Websites and all other services are accessible.

When looking towards Office365, the following services are supported ;

  • Exchange Online & Exchange Online Protection
  • SharePoint Online
  • Skype for Business Online
  • Office Online
  • Azure AD & Azure AD Sync
  • Office 365 Video
  • Power BI
  • Delve
  • Project Online

The following Office 365 services are not supported ;

  • Yammer
  • Office 365 ProPlus client downloads
  • On-premises Identity Provider Sign-In
  • Office 365 (operated by 21 Vianet) service in China

(Though you can connect to these services over the internet)

Source ; ExpressRoute FAQ