Deliver IoT SIM traffic privately into Microsoft Azure

Updated 26 October 2026

To deliver IoT SIM traffic privately into Azure, your SIMs use a private APN and their traffic reaches your virtual networks over an ExpressRoute circuit with private peering. Devices keep private IP addresses, are invisible from the internet, and reach your VNets as if they were part of your own network. An IPsec tunnel to an Azure VPN Gateway is the quicker, internet-routed alternative.

Status: Coming soon (checked 26 October 2026) · Notify me when available

Key points

ExpressRoute private peering. Microsoft describes it as a trusted extension of your core network into Azure, reaching VMs and services on their private IPs (circuits and peering).
Redundant by design. Each peering runs a pair of independent BGP sessions.
Bandwidths. Circuits through a connectivity provider range from 50 Mbit/s to 10 Gbit/s, per Microsoft.
VPN option. Azure VPN Gateway for a fast start, over the internet, encrypted.

Reference architecture

IoT device ── mobile network ── private APN ── ExpressRoute circuit (private peering, 2 x BGP)
                                                     │
                                                     ▼
                                      ExpressRoute virtual network gateway
                                                     │
                                                     ▼
                                     Hub VNet ── spoke VNets (IoT backend, analytics)

Steps

Create the ExpressRoute circuit in your subscription, choosing the connectivity provider and peering location we indicate, and the bandwidth you need.
Send us the service key of the circuit.
We provision our side, then private peering is configured with its two BGP sessions.
Link your VNet to the circuit through an ExpressRoute virtual network gateway (how to link a VNet).
Filter with network security groups so that only the SIM range reaches your IoT backend.
Test from a device: a private IP in your VNet must answer.

Learn more

Frequently asked questions

How do cellular IoT devices reach an Azure VNet privately?

The SIMs use a private APN and their traffic is handed to Azure over an ExpressRoute circuit with private peering, which connects to your virtual networks on their private IP addresses.

What do I need to give to set up ExpressRoute?

The service key of the ExpressRoute circuit you create in your Azure subscription. Microsoft describes it as the only information exchanged between Microsoft, the connectivity provider and you, and says it is not a secret.

Can I start with a VPN instead?

Yes. An IPsec tunnel to an Azure VPN Gateway works within hours. It is encrypted but crosses the public internet; ExpressRoute does not.