An organization has deployed a web API to Azure API Management (APIM). The API must be secured so that it only accepts requests from client applications that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. The token must contain an audience (aud) claim of api://backend-api and a scope (scp) claim of API.Read. Invalid requests must be rejected immediately with a 401 HTTP status code before reaching the backend service.
Which policy configuration should you apply?
- A<inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<issuer-signing-keys>
<key>{{keyvault-signing-key}}</key>
</issuer-signing-keys>
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</inbound> - B<outbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</outbound> - <inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</inbound>Answer - D<inbound>
<base />
<authentication-managed-identity resource="api://backend-api" />
</inbound>
Answer
The configuration that places the validate-jwt policy inside the inbound section and validates the audience and the scp claim via the openid-config configuration.
The correct policy configuration uses the <validate-jwt> policy within the <inbound> block. This configuration retrieves Microsoft Entra ID metadata dynamically via the openid-config URL, ensures that the token audience is verified, and requires the scope (scp) claim to contain the correct value. Evaluating this inbound ensures unauthenticated requests are blocked before they reach the backend service.
Step-by-Step Solution
Key Concept
Securing API Management endpoints by validating inbound JSON Web Tokens (JWT) using Microsoft Entra ID and policy claims.