{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "slug": "dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration", "url": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/" }, "title": "Document the temporary ExpressRoute transit path during a Virtual WAN migration", "summary": "Treat staged-migration connectivity as its own acceptance case.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:08+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 224, "potentially_affected": "Use this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.", "dse_recommendation": "DSE recommends documenting the temporary path separately from the intended final architecture.", "primary_source": { "name": "Architecture: Migrate to Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s staged Virtual WAN migration example connects both the original customer-managed hub and the new Virtual WAN hub to the same ExpressRoute circuit. In that example, traffic between spokes attached to the two environments traverses the circuit’s Microsoft enterprise-edge devices. The shared connection enables migration of spokes in stages. Microsoft Learn.

\n

Applicability

\n

Use this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.

\n

DSE recommendation

\n

DSE recommends documenting the temporary path separately from the intended final architecture. List dependencies that must cross between migrated and unmigrated spokes and agree their expected behavior with application owners. Preserve the old connection configuration and define a stage-specific recovery decision before moving a spoke. Review the complete current guidance for SKU, security and routing conditions.

\n

Verification

\n

During the authorized pilot stage, inspect effective routes and test representative communication in both directions across the coexistence boundary. Confirm the intended transit path and relevant security decisions. Retain the results for that stage, then repeat the dependency checks after the next move. Do not use final-state connectivity tests as a substitute for validating the temporary arrangement.

\n

Official references

\n

Microsoft Learn: Architecture: Migrate to Azure Virtual WAN.

", "content_text": "Source facts\nMicrosoft’s staged Virtual WAN migration example connects both the original customer-managed hub and the new Virtual WAN hub to the same ExpressRoute circuit. In that example, traffic between spokes attached to the two environments traverses the circuit’s Microsoft enterprise-edge devices. The shared connection enables migration of spokes in stages. Microsoft Learn.\nApplicability\nUse this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.\nDSE recommendation\nDSE recommends documenting the temporary path separately from the intended final architecture. List dependencies that must cross between migrated and unmigrated spokes and agree their expected behavior with application owners. Preserve the old connection configuration and define a stage-specific recovery decision before moving a spoke. Review the complete current guidance for SKU, security and routing conditions.\nVerification\nDuring the authorized pilot stage, inspect effective routes and test representative communication in both directions across the coexistence boundary. Confirm the intended transit path and relevant security decisions. Retain the results for that stage, then repeat the dependency checks after the next move. Do not use final-state connectivity tests as a substitute for validating the temporary arrangement.\nOfficial references\nMicrosoft Learn: Architecture: Migrate to Azure Virtual WAN.", "content_markdown": "## Source facts\n\nMicrosoft’s staged Virtual WAN migration example connects both the original customer-managed hub and the new Virtual WAN hub to the same ExpressRoute circuit. In that example, traffic between spokes attached to the two environments traverses the circuit’s Microsoft enterprise-edge devices. The shared connection enables migration of spokes in stages. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology).\n\n## Applicability\n\nUse this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.\n\n## DSE recommendation\n\nDSE recommends documenting the temporary path separately from the intended final architecture. List dependencies that must cross between migrated and unmigrated spokes and agree their expected behavior with application owners. Preserve the old connection configuration and define a stage-specific recovery decision before moving a spoke. Review the complete current guidance for SKU, security and routing conditions.\n\n## Verification\n\nDuring the authorized pilot stage, inspect effective routes and test representative communication in both directions across the coexistence boundary. Confirm the intended transit path and relevant security decisions. Retain the results for that stage, then repeat the dependency checks after the next move. Do not use final-state connectivity tests as a substitute for validating the temporary arrangement.\n\n## Official references\n\n[Microsoft Learn: Architecture: Migrate to Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Document the temporary ExpressRoute transit path during a Virtual WAN migration", "item": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/", "headline": "Document the temporary ExpressRoute transit path during a Virtual WAN migration", "description": "Treat staged-migration connectivity as its own acceptance case.", "abstract": "Treat staged-migration connectivity as its own acceptance case.", "articleBody": "Source facts\nMicrosoft’s staged Virtual WAN migration example connects both the original customer-managed hub and the new Virtual WAN hub to the same ExpressRoute circuit. In that example, traffic between spokes attached to the two environments traverses the circuit’s Microsoft enterprise-edge devices. The shared connection enables migration of spokes in stages. Microsoft Learn.\nApplicability\nUse this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.\nDSE recommendation\nDSE recommends documenting the temporary path separately from the intended final architecture. List dependencies that must cross between migrated and unmigrated spokes and agree their expected behavior with application owners. Preserve the old connection configuration and define a stage-specific recovery decision before moving a spoke. Review the complete current guidance for SKU, security and routing conditions.\nVerification\nDuring the authorized pilot stage, inspect effective routes and test representative communication in both directions across the coexistence boundary. Confirm the intended transit path and relevant security decisions. Retain the results for that stage, then repeat the dependency checks after the next move. Do not use final-state connectivity tests as a substitute for validating the temporary arrangement.\nOfficial references\nMicrosoft Learn: Architecture: Migrate to Azure Virtual WAN.", "datePublished": "2026-09-17T16:33:08+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Document the temporary ExpressRoute transit path during a Virtual WAN migration" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 224, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Architecture: Migrate to Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology" } } ] } }