In reply to Tony.

Hi Tony, Express Route connections to Azure are not encrypted. Technically Express Route connections are private, not shared or routed on the public internet, but that does not mean they are necessarily secure. With the CSR 1000v you can secure you Express Route connection while seamless integrating Azure with your existing VPN architecture. The CSR 1000v supports up to 1000 VPN tunnels so you can scale your VPN connections and implement different VPN technologies like DMVPN, EZVPN and GETVPN.

Matthew