Using Express Route for Azure ATP sensors

[markwarnes]

Has anyone ever tried using Azure ATP sensors over Express route and have some details on how it is done? For domain controllers that do not have internet access (and cannot have the TCP 443 opened up, even if only outbound) but that do have access to Express Route, this would be useful information to have and provide a good (and cheaper) alternative to using standalone sensors with port mirroring.

[#2]

@Andrew Harris (AZURE SEC): Is this something you can speak to?  

[#3]

@Valon_Kolica @markwarnes 

Azure ATP (AATP) does not support Express route. This is something that should work when Secops Unified Portal is released. This is the merging of the Azure ATP and Microsoft Cloud App Security (MCAS) consoles are unified. 

So since MCAS supports ExpressRoute this should be something that AATP will also support. 

You can read about the Secops unified portals in this blog from the RSA announcements. 

Unified SecOps: https://aka.ms/unifiedportal

[#4]

@Gerson Levitz- Thanks for your reply, and for confirming that Azure ATP does not (currently) support ExpressRoute.

It will be interesting to see how the new unified SecOps portal brings the three products together, and how this might introduce the ExpressRoute capability for Azure ATP, but for now it looks like a standalone Azure ATP sensor server will need to be used for my customer.

[#5]

Seeing as this was over a year ago, does anyone know if it's possible for on-prem AD servers running the AATP sensor to communicate with the service over express route yet?

[#6]

@jgriff100 Still not possible.