No Expressroute for IoT Devices Enough?

Hello Jester Bojorque,
Thanks for reaching out to Microsoft Q&A. 

Based on your network diagram, you have a hub-and-spoke topology that includes:

1. IoT devices connecting via ExpressRoute through a Virtual Network Gateway
2. Several Azure services (such as IoT Hub, App Services, Storage, etc.) utilizing private endpoints
3. TLS 1.2 encryption already enabled on your IoT devices

Solution: ExpressRoute Can Be Successfully Retired
Yes, you can disconnect ExpressRoute without impacting your security. That's because:

Security Evaluation

TLS 1.2 Encryption Provides Strong Security

• Your IoT devices are equipped with TLS 1.2, offering end-to-end encryption
• Data stays encrypted during transmission, even over public networks
• This aligns with industry security standards for IoT communication

Supporting Document:

Azure IoT Hub support for virtual networks | Microsoft Learn

**
Private Endpoints Remove Public Internet Exposure

• Azure services can be accessed through private endpoints within your VNet.
• All traffic is routed over Microsoft’s backbone network, avoiding the public internet.
• Private Link ensures network-level isolation.

Use the following document for cost optimization
Pricing - ExpressRoute | Microsoft Azure

Recommended Architecture After ExpressRoute Removal

IoT Devices (TLS 1.2) → Internet → Azure Private Endpoints → Azure Services
This setup provides a balanced level of security while keeping costs under control.

Step-by-Step Migration Plan

1. Validate Current Security Configuration
   • Ensure all IoT devices are using TLS 1.2 or above, and verify that private endpoints are set up for all Azure services.
     • After configuration, test connectivity through the private endpoints.
     1. Optional: Implement Additional Security Measures
        • Set up Network Security Groups (NSGs) to enhance traffic filtering.
          • If advanced threat protection is required, enable Azure Firewall and configure monitoring and logging for network traffic.
2. Gradual Migration Process
   • Begin by testing a small group of IoT devices connecting directly via the internet and monitor both performance and security metrics.
   • Continue migrating all devices in stages and decommission ExpressRoute resources at the end.

Scenarios for Retaining ExpressRoute:

You should consider retaining ExpressRoute if you have any of the following needs:

• Compliance standards that require private, physical network connections
• Consistently high bandwidth usage (over 1 Gbps)
• Requirements for extremely low latency (under 5ms)
• Regulations that prevent data from passing over the public internet

Performance Considerations

• Latency: There may be an increase of 5-20ms in latency when compared to ExpressRoute.
• Bandwidth: Most IoT workloads can be supported efficiently by internet connections.
• Reliability: Modern internet connections typically offer uptime of 99.9% or higher.

Your setup, which includes TLS 1.2 encryption and private endpoints, offers strong security even without ExpressRoute. By using:

• TLS 1.2 for application-layer encryption
• Private Endpoints for network-level protection
• Azure's secure backbone network

This establishes a secure communication channel, making ExpressRoute's private connection unnecessary from a security standpoint.

Kindly let us know if the above helps or you need further assistance on this issue.