ExpressRoute is the line item nobody questions. It sits on the Azure bill every month, a fixed cost that rarely changes, and everyone assumes it's just what networking costs.
We regularly see ExpressRoute accounting for 4-6% of total Azure spend. Thousands per month on a circuit running at a fraction of its capacity. Because it's a fixed charge, it never triggers the alarms that spike-based services do.
The Bandwidth Tier Problem
ExpressRoute pricing jumps significantly between tiers: 50Mbps, 100Mbps, 200Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps. Someone estimates peak requirements, adds a growth margin, rounds up "just in case", and submits the order.
Three years later, you're paying for 1Gbps when your average utilisation is 120Mbps and your peak barely touches 400Mbps.
Why Over-Provisioning Sticks
- Peak capacity planning. Circuit sized for a monthly peak or a migration that finished two years ago.
- Growth that never came. Planned workloads that didn't materialise, but the tier stayed.
- Fear of downgrading. Nobody wants to cause a bottleneck during a critical process. The cost of over-provisioning is invisible (money). The cost of under-provisioning is very visible (downtime).
- "It's just networking." Network budgets sit in a different pot and don't get the same FinOps scrutiny.
ExpressRoute Direct: Do You Need It?
ExpressRoute Direct gives dedicated physical ports at 10Gbps or 100Gbps with features like MACsec encryption. Premium product, premium price.
We've seen organisations running Direct because it was recommended during an initial Azure design engagement, when a standard circuit would have been more than adequate. If you're not using Direct-exclusive features or dedicated port capacity, a standard circuit at the right tier delivers the same performance for far less.
Standard vs Premium SKU
ExpressRoute comes in Standard and Premium SKUs. Premium gives you global connectivity across all Azure regions, higher route limits (10,000 vs 4,000), and more VNet links. It also costs significantly more.
Most UK organisations only use UK and European Azure regions. If you're on Premium but your workloads are all in UK South and UK West, you're paying for global reach you'll never use. Downgrading to Standard is a straightforward change with immediate savings. Worth checking.
Peering Types and Add-Ons
Private peering connects to your VNets. Microsoft peering connects to M365/Dynamics. Not every organisation needs both. Microsoft actually recommends internet routing for M365 in most scenarios.
Global Reach connects circuits across regions via the Microsoft backbone. Useful for multi-region deployments, but if it was enabled for a project that's since completed, it's still billing.
The VPN Alternative
This question makes networking teams uncomfortable: do you actually need ExpressRoute?
For consistent high-bandwidth, strict latency, or compliance mandates, yes. But if peak utilisation is under 200Mbps with no regulatory requirement for private connectivity, a Site-to-Site VPN at a fraction of the cost might be sufficient.
A hybrid approach works well: ExpressRoute for primary high-bandwidth connections, VPN for secondary or lower-traffic sites.
The Pattern
ExpressRoute is a premium service and it delivers premium connectivity. The problem isn't the service. It's that organisations provision it once and never revisit. Every other Azure resource gets regular cost reviews. Networking somehow gets a pass.
If your 1Gbps circuit has a 95th percentile of 350Mbps, you could be running on 500Mbps and saving hundreds per month. You just have to look.
Not sure whether your ExpressRoute is right-sized? Request a FinOps assessment. We analyse utilisation data and show you where the savings are.