Network-to-network & hybrid connectivity
AWS Transit Gateway vs Azure Virtual WAN / Azure Virtual Network Manager
AWS Transit Gateway maps to Azure Virtual WAN.
Many Azure designs instead build a customer-managed hub virtual network (with Azure Firewall or an NVA, plus gateways), optionally deployed with Virtual Network Manager.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Transit Gateway | Azure Virtual WAN Azure Virtual Network Manager |
| Lifecycle | Generally available | Generally available Generally available |
| What it is | Regional cloud router that connects VPCs, VPNs, Direct Connect, and peered transit gateways in a hub-and-spoke design, with multiple route tables for segmentation. | Microsoft-managed hubs (full mesh in the Standard type) that connect virtual networks, branches (VPN and SD-WAN), remote users, and ExpressRoute, with optional secured hubs using Azure Firewall. Centrally groups virtual networks across subscriptions and regions to deploy connectivity (mesh or hub-and-spoke), security admin rules, routing, and IP address management (IPAM) pools. |
| Pricing model | Per attachment-hour plus per GB processed. | Virtual WAN Standard hubs are billed per hub-hour plus data processed and per connection unit (VPN, ExpressRoute, and user VPN scale units). |
| Docs | AWS Transit Gateway docs | Azure Virtual WAN docs Azure Virtual Network Manager docs |
| Pricing page | AWS Transit Gateway pricing | Azure Virtual WAN pricing Azure Virtual Network Manager pricing |
| Exams | SAA-C03 ANS-C01 Retiring SAP-C02 Retiring | AZ-700 AZ-305 |
Key differences
- Scope. Transit Gateway is regional and peers with other transit gateways across Regions. Virtual WAN hubs in a Standard virtual WAN are fully meshed across regions automatically.
- Security. Virtual WAN can host Azure Firewall or partner NVAs in secured hubs, managed through Firewall Manager. On AWS, inspection usually uses an inspection VPC with Network Firewall or a Gateway Load Balancer, or native Network Firewall attachments.
- Routes. Microsoft's comparison notes that Transit Gateway allows 100 BGP prefixes per attachment, while Virtual WAN private peering allows 1,000. Check current quotas for your design.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per attachment-hour plus per GB processed. AWS Transit Gateway pricing →
- Azure
- Virtual WAN Standard hubs are billed per hub-hour plus data processed and per connection unit (VPN, ExpressRoute, and user VPN scale units). Azure Virtual WAN pricing → Azure Virtual Network Manager pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| AWS Certified Solutions Architect – Professional SAP-C02 | AWS | Professional | retiring Being updated to SAP-C03. Registration for SAP-C03 opens Oct 27, 2026. Last day to take SAP-C02 is Nov 16, 2026. |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
| Microsoft Certified – Azure Solutions Architect Expert AZ-305 | Azure | Expert | current English version updated Apr 17, 2026. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Transit Gateway?
AWS Transit Gateway maps to Azure Virtual WAN. Many Azure designs instead build a customer-managed hub virtual network (with Azure Firewall or an NVA, plus gateways), optionally deployed with Virtual Network Manager.
How does pricing compare between AWS Transit Gateway and Azure Virtual WAN and Azure Virtual Network Manager?
AWS: Per attachment-hour plus per GB processed. Azure: Virtual WAN Standard hubs are billed per hub-hour plus data processed and per connection unit (VPN, ExpressRoute, and user VPN scale units). Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; AWS Certified Solutions Architect – Professional (SAP-C02) [retiring]; Microsoft Certified – Azure Network Engineer Associate (AZ-700); Microsoft Certified – Azure Solutions Architect Expert (AZ-305).