# Complete the rule and circuit association when creating an ExpressRoute route filter

> A route-filter resource alone does not express the intended service-prefix selection.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:01+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

A route-filter resource alone does not express the intended service-prefix selection.

## Potentially affected

Apply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.

## DSE recommendation

DSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items.

## Article

## Source facts

Microsoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal).

## Applicability

Apply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.

## DSE recommendation

DSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.

## Verification

Inspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.

## Official references

[Microsoft Learn: Configure route filters for Microsoft peering](https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal).

## Primary reference

- Name: Configure route filters for Microsoft peering | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Complete the rule and circuit association when creating an ExpressRoute route filter,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.