Crisp answer: Site-to-Site VPN uses an IPSec tunnel over the public internet — quick to set up, lower cost, variable latency. ExpressRoute is a dedicated private circuit to Azure — consistent bandwidth, lower latency, higher cost. Azure Arc extends Azure management to on-premises and other cloud resources.
Site-to-Site VPN:
Components:
VPN Gateway: Azure-side endpoint, deployed in its own GatewaySubnet (/27 minimum)
Local Network Gateway: represents your on-prem network (IP + CIDR)
Connection: links the two, uses Pre-Shared Key or certificate auth
Bandwidth: up to 10 Gbps (VpnGw5 SKU)
Latency: variable (internet path)
Redundancy: active-active configuration for HA
Cost: VpnGw1 ~£230/month + data egress
Use for:
- Branch offices
- Dev/test hybrid connectivity
- Backup connectivity alongside ExpressRoute
ExpressRoute:
Dedicated private circuit via a connectivity provider (BT, Equinix, etc.)
Traffic never touches the public internet
Bandwidth: 50 Mbps to 100 Gbps
Latency: consistent, typically <5ms to nearest Azure region
Redundancy: two circuits mandatory for the SLA
ExpressRoute Gateway in your VNet bridges the circuit to your VNets.
ExpressRoute Global Reach: connect two on-prem sites via Microsoft backbone.
Cost: circuit £100-£3000/month + gateway ~£400/month
Use for:
- Production workloads with compliance requirements (data must not
traverse public internet)
- High-bandwidth data transfer (bulk migration, backup)
- Low-latency requirements (trading, real-time processing)
Azure Arc:
Extends Azure Resource Manager to resources outside Azure:
- On-premises Windows and Linux servers
- VMware VMs
- AKS clusters on-prem or other clouds (GKE, EKS)
- SQL Server on-prem
What Arc-enabling gives you:
- Resource appears in Azure portal as an Azure resource
- Azure Policy enforcement on the resource
- Defender for Cloud protection
- Azure Monitor agent deployment
- RBAC-controlled access via Entra ID
- GitOps for Arc-enabled Kubernetes clusters
How to Arc-enable a server:
# Download and run the Arc onboarding script
az connectedmachine connect \
--name my-server \
--resource-group my-rg \
--location uksouth \
--subscription SUB_ID
What to say in the interview:
"For our hybrid setup at the RHS we used Site-to-Site VPN for connectivity between on-prem and Azure — it was the right balance of cost and functionality for our requirements. At Airinmar when we were doing the VMware to Azure migration we used S2S VPN to establish connectivity, then ran the migration waves over it. For Arc, I used it to extend Defender for Cloud to on-prem servers so we had a single security posture view across the whole estate rather than having to check on-prem and Azure separately."