Question

A retail company exposes several internal microservices through Azure API Management (Standard tier) to third-party partner developers. During flash sales, a few partners generate bursts of traffic that overwhelm the backend microservices, causing timeouts for all consumers. The architecture team wants to protect the backends by capping how many calls each partner subscription can make per time window, and reduce load for repeated identical read requests, without modifying the microservice code. Which combination of API Management capabilities should you recommend?

Accepted Answer

Apply a rate-limit-by-key (or quota-by-key) inbound policy keyed on the subscription, and add a cache-lookup/cache-store response caching policy for idempotent GET operations.

Answer

Enable Azure Front Door in front of API Management and rely on its WAF managed rules to block excessive partner traffic.

Answer

Scale out the backend microservices with a VM Scale Set autoscale rule and place an Azure Load Balancer in front of them.

Answer

Switch API Management to the Consumption tier and enable built-in per-consumer automatic throttling and caching.