AZ-305
Deep Dive
API Management is the facade for your APIs: authentication, rate limiting, transformation and versioning, all without touching the backends. The AZ-305 also expects you to distinguish it from App Gateway and Front Door — and to know when the problem is solved with Logic Apps instead.
Contents
APIM has three components: the gateway (the proxy every request passes through), the management plane (configuring APIs and policies) and the developer portal (auto-generated docs, self-service subscriptions and testing for consumers).
What it solves
Model concepts
| Policy | Does | Exam signal |
|---|---|---|
| rate-limit / rate-limit-by-key | Limits calls per period (per subscription or a custom key like IP) | "Limit to 100 calls per minute per client" |
| quota | Long-term volume limit (month) | "Max 10,000 calls per month per plan" |
| validate-jwt | Validates Entra ID/OAuth tokens before passing to the backend | "Only Entra ID authenticated users call the API" |
| cache-lookup / cache-store | Caches responses at the gateway | "Reduce backend load for identical responses" |
| set-header / rewrite-uri | Transforms requests/responses | "Adapt legacy clients to the new backend" |
| ip-filter | Allows/blocks IP ranges | "Only the partner's IPs" |
| retry / circuit logic | Resilience towards backends | "Tolerate transient backend failures" |
Policies apply in 4 phases (inbound → backend → outbound → on-error) and 4 scopes (global → product → API → operation), inheriting downward.
| Tier | Key point |
|---|---|
| Consumption | Serverless, pay per call, no VNet — lightweight, variable APIs |
| Basic/Standard (+v2) | General production; v2 with private endpoints/VNet integration |
| Premium | VNet injection (internal/external), multi-region active-active, zones, self-hosted gateway — the answer to "gateway INSIDE the VNet" or "APIs in multiple regions" |
Typical exam topology
APIM Premium in internal mode (private IP only, inside the VNet) + Application Gateway with WAF in front as the public entry point. Internal APIs stay private; public ones are exposed filtered by the WAF.
| Service | Is | Is NOT |
|---|---|---|
| API Management | API governance: auth, quotas, versioning, portal, transformation | A load balancer or a WAF |
| Application Gateway | REGIONAL L7 load balancer with WAF, TLS termination, path routing | Doesn't manage API lifecycle or per-consumer quotas |
| Front Door | GLOBAL entry point: anycast, CDN, WAF, multi-region failover | Doesn't replace APIM (no quotas/portal) nor load-balances within a VNet |
They COMBINE: Front Door (global) → App Gateway/WAF (regional) → APIM (governance) → backends. The exam question usually asks you to identify which layer provides what.
When to use Logic Apps
Logic Apps vs Functions vs Durable Functions
| Requirement | Design |
|---|---|
| Different rate limiting per client plan | APIM products + rate-limit/quota |
| Validate Entra ID tokens before the backend | APIM validate-jwt |
| Expose legacy SOAP as modern REST | APIM transformation |
| Self-service documentation portal for partners | APIM developer portal |
| API gateway running on-premises, central management | APIM self-hosted gateway |
| APIM accessible only in the VNet + public entry with WAF | APIM Premium internal + App Gateway WAF |
| APIs active in 3 regions with a single management plane | APIM Premium multi-region |
| Flow: order → approval → SAP → email, no code | Logic Apps |
| Fan-out/fan-in of 1000 tasks in code | Durable Functions |
Did you get this topic?
Test what you just learned
A company exposes 40 microservices (AKS and Functions) to external partners. Requirements: (1) each partner has call limits based on their contracted plan, (2) partners must be able to explore documentation and test APIs themselves, (3) Entra ID JWT tokens must be validated before reaching the backends. What service centralizes all three requirements?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.