# Check prefix specificity before raising an ExpressRoute connection weight

> A weight comparison should account for the actual prefixes advertised over each circuit.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:02+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

A weight comparison should account for the actual prefixes advertised over each circuit.

## Potentially affected

Apply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.

## DSE recommendation

DSE recommends explaining the current route choice from the complete prefix set before adjusting weight.

## Article

## Source facts

Microsoft lists more-specific route advertisement ahead of connection weight and AS-path prepending when describing ExpressRoute path-selection influence. Its example advertises two /25 prefixes over the preferred circuit and the covering /24 over standby. The more-specific path carries traffic normally; the /24 standby is used when both preferred-circuit connections fail. The guide describes highest connection weight as the preference when the same prefix arrives over multiple circuits. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering).

## Applicability

Apply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.

## DSE recommendation

DSE recommends explaining the current route choice from the complete prefix set before adjusting weight. Identify whether the competing advertisements represent the same prefix or overlapping ranges. Have the routing owner approve any revised advertisement and preserve the prior configuration, including the intended standby coverage.

## Verification

Inspect the selected route for representative destinations inside each relevant range. In an approved maintenance test, confirm the expected selection with the preferred path available and under the planned failure condition. Record both the advertised prefixes and selected circuit so the result can be reproduced without assuming the highest displayed weight controls every destination.

## Official references

[Microsoft Learn: Azure ExpressRoute: Designing for disaster recovery](https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering).

## Primary reference

- Name: Azure ExpressRoute: Designing for disaster recovery | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check prefix specificity before raising an ExpressRoute connection weight,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.