Choose ExpressRoute Direct encapsulation with the correct VLAN uniqueness boundary

Source facts

ExpressRoute Direct supports QinQ and Dot1Q. With QinQ, Azure dynamically assigns each circuit an S-Tag unique across the Direct resource; C-Tags must be unique within the circuit, but not across the entire Direct resource.

With Dot1Q, the customer must ensure C-Tag uniqueness across the whole Direct resource. Microsoft states that a Direct resource can use only one encapsulation type and that this choice cannot be changed after creation. Microsoft Learn.

Applicability

Identify the planned Direct resource, participating circuits and connected equipment’s approved encapsulation. Keep the resource’s allocation boundary distinct from the VLAN convention used elsewhere in the organization.

DSE recommendation

DSE recommends an allocation record showing every circuit and the scope in which each tag must be unique. Review it with the teams responsible for the physical cross-connections and router configuration before resource creation. Resolve duplicate or ambiguous assignments at design time. Do not assume a later portal edit can switch the encapsulation to accommodate an inconsistent tag plan.

Verification

Compare the created resource’s encapsulation and circuit tags with the approved allocation record. During the authorized connectivity test, verify the intended circuit and tagging at the relevant interfaces. Record any mismatch before adding another circuit. Retain both the Azure values and the corresponding equipment configuration so a successful link state is not mistaken for proof that every planned logical circuit is mapped correctly.

Official references

Microsoft Learn: Configure Azure ExpressRoute Direct. Source retrieved September 9, 2026.