ExpressRoute Direct and MACsec: encryption at the link layer

Standard ExpressRoute delivered through a connectivity partner is sufficient for most organisations. In banking, however, a question comes up that is hard to answer affirmatively: apart from us, who has physical access to the medium carrying production data?

What actually differs

In the partner model, the circuit is shared at the level of the operator’s infrastructure. ExpressRoute Direct changes that arrangement — the institution receives dedicated 10 or 100 Gbps ports terminated directly on Microsoft edge devices.

This opens the door to MACsec (IEEE 802.1AE), encryption at layer two. Traffic is protected between the customer edge router and the Microsoft port, regardless of what happens a layer above.

What to prepare

Enabling MACsec requires a few decisions that are best made before ordering ports:

• Key storage. The CAK and CKN must live in Azure Key Vault, and the circuit’s managed identity needs access to them. Key rotation should be planned as an operational procedure, not a one-off task.
• Edge hardware compatibility. Not every router supports MACsec with the required cipher suite. Verify this with your network team before committing to a connectivity model.
• Sequencing. MACsec configuration on the customer and Microsoft sides has to be coordinated in time — mismatched keys will drop sessions on both circuits simultaneously if the change is applied outside a maintenance window.

What MACsec does not solve

MACsec protects a single physical segment. It does not replace application-level encryption or IPsec for traffic that crosses multiple routing domains. In documentation prepared for an auditor it is worth separating these layers explicitly — a control stated as “data encrypted in transit” is often read more broadly than the actual reach of MACsec justifies.

Conclusion

ExpressRoute Direct with MACsec is justified where exclusive use of the medium follows from regulation or from the institution’s security policy. In other cases the cost of dedicated ports is rarely warranted — standard ExpressRoute with encryption at higher layers achieves the same business outcome.