Complete the rule and circuit association when creating an ExpressRoute route filter

Source facts

Microsoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. Microsoft Learn.

Applicability

Apply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.

DSE recommendation

DSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.

Verification

Inspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.

Official references

Microsoft Learn: Configure route filters for Microsoft peering.