An organization is deploying an API to Azure API Management (APIM) that communicates with a backend service hosted on Azure App Service. The API must meet the following security requirements:
1. Inbound requests to APIM must be authenticated using OAuth 2.0. APIM must validate that the JWT contains a claim named "roles" containing the value "Writer", and that the token is issued specifically by the company's Azure AD tenant (contoso.onmicrosoft.com). If validation fails, a 401 Unauthorized status must be returned.
2. APIM must authenticate to the backend App Service using a User-Assigned Managed Identity named "apim-identity" (Client ID: 11111111-1111-1111-1111-111111111111).
Which of the following policy configurations should you implement in the APIM policy definition to meet these requirements?
- <inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration" />
<required-claims>
<claim name="roles" match="any">
<value>Writer</value>
</claim>
</required-claims>
</validate-jwt>
<authentication-managed-identity resource="https://backend.contoso.com" client-id="11111111-1111-1111-1111-111111111111" />
</inbound>Cevap - B<inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration" />
<required-claims>
<claim name="roles" match="any">
<value>Writer</value>
</claim>
</required-claims>
</validate-jwt>
<authentication-managed-identity resource="https://backend.contoso.com" identity-id="/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/apim-identity" />
</inbound> - C<inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration" />
<required-claims>
<claim name="roles" match="any">
<value>Writer</value>
</claim>
</required-claims>
</validate-jwt>
</inbound>
<outbound>
<base />
<authentication-managed-identity resource="https://backend.contoso.com" client-id="11111111-1111-1111-1111-111111111111" />
</outbound> - D<inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration" />
<required-claims>
<claim name="roles" match="any">
<value>Writer</value> </claim> </required-claims>
</validate-jwt>
<authentication-managed-identity resource="https://backend.contoso.com" />
</inbound>