# Document the temporary ExpressRoute transit path during a Virtual WAN migration

> Treat staged-migration connectivity as its own acceptance case.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:08+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Treat staged-migration connectivity as its own acceptance case.

## Potentially affected

Use this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.

## DSE recommendation

DSE recommends documenting the temporary path separately from the intended final architecture.

## Article

## Source facts

Microsoft’s staged Virtual WAN migration example connects both the original customer-managed hub and the new Virtual WAN hub to the same ExpressRoute circuit. In that example, traffic between spokes attached to the two environments traverses the circuit’s Microsoft enterprise-edge devices. The shared connection enables migration of spokes in stages. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology).

## Applicability

Use this review only where the proposed migration follows that shared-circuit pattern. Identify the two hubs, their connections, the spokes moving in each stage and the application dependencies spanning them. The example is not proof that every coexistence topology has the same transit path.

## DSE recommendation

DSE recommends documenting the temporary path separately from the intended final architecture. List dependencies that must cross between migrated and unmigrated spokes and agree their expected behavior with application owners. Preserve the old connection configuration and define a stage-specific recovery decision before moving a spoke. Review the complete current guidance for SKU, security and routing conditions.

## Verification

During the authorized pilot stage, inspect effective routes and test representative communication in both directions across the coexistence boundary. Confirm the intended transit path and relevant security decisions. Retain the results for that stage, then repeat the dependency checks after the next move. Do not use final-state connectivity tests as a substitute for validating the temporary arrangement.

## Official references

[Microsoft Learn: Architecture: Migrate to Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology).

## Primary reference

- Name: Architecture: Migrate to Azure Virtual WAN | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Document the temporary ExpressRoute transit path during a Virtual WAN migration,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-112-document-the-temporary-expressroute-transit-path-during-a-virtual-wan-migration/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.