These reference architectures show proven practices for creating a robust network connection between an on-premises network and Azure. Which should I choose?
Extend an on-premises network to Azure using a site-to-site virtual private network (VPN).
Extend an on-premises network to Azure using Azure ExpressRoute
ExpressRoute with VPN failover
Extend an on-premises network to Azure using Azure ExpressRoute, with a VPN as a failover connection.
The hub is a central point of connectivity to your on-premises network. The spokes are VNets that peer with the hub, and can be used to isolate workloads.