Forum Discussion
Using Express Route for Azure ATP sensors
Has anyone ever tried using Azure ATP sensors over Express route and have some details on how it is done? For domain controllers that do not have internet access (and cannot have the TCP 443 opened up, even if only outbound) but that do have access to Express Route, this would be useful information to have and provide a good (and cheaper) alternative to using standalone sensors with port mirroring.
- Valon_Kolica
Microsoft
Andrew Harris (AZURE SEC): Is this something you can speak to?
Azure ATP (AATP) does not support Express route. This is something that should work when Secops Unified Portal is released. This is the merging of the Azure ATP and Microsoft Cloud App Security (MCAS) consoles are unified.
So since MCAS supports ExpressRoute this should be something that AATP will also support.
You can read about the Secops unified portals in this blog from the RSA announcements.
Unified SecOps: https://aka.ms/unifiedportal
Gerson Levitz- Thanks for your reply, and for confirming that Azure ATP does not (currently) support ExpressRoute.
It will be interesting to see how the new unified SecOps portal brings the three products together, and how this might introduce the ExpressRoute capability for Azure ATP, but for now it looks like a standalone Azure ATP sensor server will need to be used for my customer.
