Track 19: Azure API Management (APIM)

By now you can put a backend service on the internet: a Container App with external ingress (track 06), or an AKS workload behind an Ingress controller (track 07). That gives you a reachable URL — but a raw URL is not the same thing as a managed API product. It has no subscription keys, no rate limits, no per-consumer analytics, no versioning story, no developer portal, and no place to centrally enforce authentication. This track adds the layer that sits in front of those backends and turns them into products: Azure API Management (APIM).

You'll front the exact Container Apps and AKS backends you built earlier with a real API gateway, import an OpenAPI spec, version and revise APIs safely, write policies (rate limiting, quotas, IP filtering, request/response transformation), validate Entra ID JWTs at the gateway (tying directly into the identity work from track 16), integrate backends over a VNet, group APIs into products with subscription keys, and wire APIM's analytics into Application Insights alongside the observability stack from track 12.

Cost warning: APIM's classic tiers — Developer, Basic, Standard, and Premium — bill continuously for as long as the instance exists, whether or not a single request flows through it, because they provision dedicated capacity ("units"). This is not like a Container App that scales to zero. The Consumption tier is pay-per-call and idles at effectively no cost, so most of this track uses it. When you do spin up a non-Consumption instance for an exercise (VNet integration and the developer portal need one), delete it the same day — az group delete --name <rg> --yes --no-wait. A forgotten Developer-tier instance left running over a weekend is a real, avoidable bill.

How this track works

• Go in order — each module assumes the ones before it. Module 01 provisions the instance every later module reuses conceptually; module 04's JWT work assumes the policy language from module 03.
• Every module except this index and the capstone follows the same shape: Why this matters → Concepts → Command reference → Hands-on exercises → Independent challenge → Common mistakes & troubleshooting → Checkpoint quiz → Next. Two modules also carry a Cumulative review.
• All exercises run real az apim / az apim api commands (and raw policy XML) against your actual Azure subscription. APIM provisioning is slow — creating a classic-tier instance can take 30–45 minutes, and even a Consumption instance takes several minutes. Every module that creates an instance calls this out so you aren't left wondering if a command hung.
• Each module ends with an explicit cleanup step. Don't skip it — see the cost warning above.
• The capstone (module 08) has no quiz or challenge scaffolding — it asks you to combine everything: APIM fronting a Container App over VNet integration, a versioned API, a rate-limit policy, JWT validation against a real Entra ID token, a product with a subscription key, and analytics showing real traffic.

Modules

Prerequisites

• An active Azure subscription (already confirmed for this curriculum).
• Everything from 06-azure-container-apps: external vs internal ingress, VNet integration, and managed identity — this track fronts those Container Apps backends.
• Ingress fundamentals from 07-aks: an AKS workload behind an Ingress controller is one of the backends you'll front.
• 16-identity-deep-dive: Entra ID, app registrations, and the anatomy of a JWT (issuer, audience, signature). Module 04's JWT validation builds directly on it. (If track 16 isn't built out yet, module 04 re-states the token facts it depends on.)

Back to main curriculum

Start here → 00-api-gateway-concepts-and-where-apim-fits/README.md