Azure API Management External User Authentication
You have an Azure API Management instance named APIM1. You need to verify the identity of external users who call the APIs in APIM1. The solution must meet the following requirements: • Follow modern secure coding practices. • Minimize code changes to the backend APIs. • Prevent anonymous users from accessing the APIs. • Ensure that you can block access for a specific user if their authentication method is compromised. What should you use?
Community Insight
The exam tests your understanding of APIM's native subscription model versus complex cryptographic methods; the trap is assuming modern security requires certificates or tokens when simple key management suffices for the stated requirements.
This question evaluates the design of authentication solutions for Azure API Management (APIM) to secure external user access. It establishes that API keys are the correct mechanism for managing identity, revocation, and preventing anonymous access while minimizing backend code changes.
Candidates often choose client certificates or shared access signatures because they sound more 'secure' or 'modern', failing to recognize that API keys in APIM provide the specific revocation capabilities required without backend integration complexity.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
API keys in Azure API Management are tied to subscriptions, which allow granular control over individual consumers. This architecture enables you to block access for a specific compromised user by suspending their subscription or regenerating their key, directly meeting the revocation requirement. Using API keys also ensures no code changes are needed on the backend APIs since APIM handles the validation before routing traffic.Why the Other Options Are Wrong
Client certificates require configuring trust stores and handling certificate lifecycle management on both sides, increasing complexity. Shared Access Signatures (SAS) are designed specifically for Azure Storage resources, not general API Management scenarios. Query string authentication is considered insecure practice as credentials can be leaked in logs and browser history, violating modern secure coding standards.Community Comment Notes
Community feedback supports API keys due to their ease of revocation via the subscription model. As gpais noted, "Per-User Subscriptions & Revocation" is the key differentiator that allows instant suspension of a compromised user's access without affecting others.Exam Strategy
When asked about blocking specific users in APIM, look for mechanisms tied to subscriptions or identities rather than network-level blocks. Always prioritize solutions that minimize backend code changes unless the requirement explicitly demands custom token validation.
Frequently Asked Questions
Why are API keys better than client certificates here?
API keys are simpler to manage and revoke individually via subscriptions, whereas certificates require complex PKI infrastructure and cannot be easily revoked per-user without reissuing.
Can API keys prevent anonymous access?
Yes, if configured correctly in APIM policies, requests without valid subscription keys will be rejected, effectively blocking anonymous users.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →