ExpressRoute Direct MACsec Architecture

To use MACsec, you need two secret values: the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN). These act like a password and its identifier. You store both secrets in Azure Key Vault, which keeps them safe and controls who can access them. Next, you create a user-assigned managed identity and give it permission to read the secrets from the vault. This identity is then linked to your ExpressRoute port, allowing Azure to retrieve the keys automatically when it needs to encrypt or decrypt traffic.