Azure API Management External User Authentication

AZ-305 By islever Editorial Last updated

Design authentication and authorization solutions

Short answer

A Use API keys to verify identity and enable per-user revocation in Azure API Management.

Question

You have an Azure API Management instance named APIM1.
You need to verify the identity of external users who call the APIs in APIM1. The solution must meet the following requirements:
• Follow modern secure coding practices.
• Minimize code changes to the backend APIs.
• Prevent anonymous users from accessing the APIs.
• Ensure that you can block access for a specific user if their authentication method is compromised.
What should you use?
  1. API keys Correct Answer
  2. client certificates
  3. query string authentication
  4. shared access signatures (SAS)

Key Takeaways

The exam tests your understanding of APIM's native subscription model versus complex cryptographic methods; the trap is assuming modern security requires certificates or tokens when simple key management suffices for the stated requirements.

This question evaluates the design of authentication solutions for Azure API Management (APIM) to secure external user access. It establishes that API keys are the correct mechanism for managing identity, revocation, and preventing anonymous access while minimizing backend code changes.

Common mistake: Candidates often choose client certificates or shared access signatures because they sound more 'secure' or 'modern', failing to recognize that API keys in APIM provide the specific revocation capabilities required without backend integration complexity.

Expert Analysis

Why the Answer Is Correct

API keys in Azure API Management are tied to subscriptions, which allow granular control over individual consumers. This architecture enables you to block access for a specific compromised user by suspending their subscription or regenerating their key, directly meeting the revocation requirement. Using API keys also ensures no code changes are needed on the backend APIs since APIM handles the validation before routing traffic.

Why the Other Options Are Wrong

Client certificates require configuring trust stores and handling certificate lifecycle management on both sides, increasing complexity. Shared Access Signatures (SAS) are designed specifically for Azure Storage resources, not general API Management scenarios. Query string authentication is considered insecure practice as credentials can be leaked in logs and browser history, violating modern secure coding standards.

Community Comment Notes

Community feedback supports API keys due to their ease of revocation via the subscription model. As gpais noted, "Per-User Subscriptions & Revocation" is the key differentiator that allows instant suspension of a compromised user's access without affecting others.

Exam Strategy

When asked about blocking specific users in APIM, look for mechanisms tied to subscriptions or identities rather than network-level blocks. Always prioritize solutions that minimize backend code changes unless the requirement explicitly demands custom token validation.

Frequently Asked Questions

Why are API keys better than client certificates here?

API keys are simpler to manage and revoke individually via subscriptions, whereas certificates require complex PKI infrastructure and cannot be easily revoked per-user without reissuing.

Can API keys prevent anonymous access?

Yes, if configured correctly in APIM policies, requests without valid subscription keys will be rejected, effectively blocking anonymous users.

More AZ-305 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. gpais 👍 1 Answered A
    A. API keys. Why this is the correct choice: • Per-User Subscriptions & Revocation: In Azure API Management (APIM), Subscriptions and API keys are the default way to grant external users access to published APIs. Each consumer or application receives a unique subscription key. If a specific user's key is compromised, an administrator can instantly suspend the subscription or regenerate the key in APIM, blocking that user without impacting anyone else. • Zero Backend Code Changes: APIM acts as a reverse proxy gateway that intercepts incoming requests and validates the subscription key (Ocp-Apim-Subscription-Key). If the key is missing or invalid, APIM rejects the request immediately at the gateway layer, requiring absolutely no code changes to your backend APIs. • Prevents Anonymous Access: By enforcing subscription key requirements on the product or API level, anonymous requests are automatically blocked b

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Storage setup retains blobs immutably for five years?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide