A credit-union reviewer asks for “encryption on the peering” betwee…

Question

A credit-union reviewer asks for “encryption on the peering” between two Azure regions. How should the security engineer respond?

Accepted Answer

State that VNet peering traffic stays on the Microsoft backbone and is not an IPsec tunnel; if network-layer encryption is required, use VPN or rely on application TLS—not a peering checkbox. — Peering isn’t a DIY IPsec tunnel—it rides Microsoft’s private backbone. Need crypto you control? Look at VPN or app TLS, not a mythical peering encryption switch.

Answer

Enable the peering IPsec checkbox so customer-managed keys wrap every packet between regions.

Answer

Disable peering and force all inter-region traffic onto the public Internet with NSG allows.

Answer

Convert both VNets to ExpressRoute private peering solely to add MACsec on the peering link.

A credit-union reviewer asks for “encryption on the peering” between two Azure regions. How should the security engineer respond?

Short Explanation

Full Explanation