Question

A retail company exposes several internal microservices through Azure API Management (APIM) to external partner applications. Security requirements state that: (1) every inbound request must present a valid OAuth 2.0 access token issued by Microsoft Entra ID before reaching any backend; (2) tokens must be rejected at the gateway if the audience or issuer is wrong; and (3) backend services must never be reachable directly, bypassing the gateway. The architect must design the APIM policy and network approach with the least custom code. Which combination BEST meets these requirements?

Accepted Answer

Apply a validate-jwt inbound policy in APIM that checks issuer and audience claims against the Entra ID metadata endpoint, and deploy APIM in internal (VNet) mode with backends restricted to the APIM subnet via NSGs/private endpoints.

Answer

Configure a subscription-key requirement on each API product and place APIM behind Azure Front Door with WAF rules that inspect the Authorization header.

Answer

Implement a custom C# request handler in each backend microservice that calls the Entra ID token introspection endpoint on every request, leaving APIM in external mode.

Answer

Enable managed identity on APIM and use an outbound set-header policy to forward the identity token to backends, relying on backend firewall rules for token validation.