Start course

This course deals with how to deploy, configure, and manage some keys aspects of Azure API management (APIM). In particular, we focus on the authentication mechanism and go into depth about how to set up OAuth 2.0, including creating the Azure AD required application registrations. To help with understanding and troubleshooting the OAuth flow, we utilize Postman to check and validate our configuration.

Next, we take a look at how we can alter API requests at various scopes using API policies. Finally, we look at how to view effective API policies that span multiple scopes and also how to trace API policies during runtime.

Learning Objectives

  • Deploy Azure API Management and import an existing API
  • Gain an understanding of how the configure authentication against APIM using OAuth 2.0
  • Implement API policies against the imported API to alter the API request
  • Use Postman to make API requests against APIM and request and use OAuth authorization tokens
  • Secure the imported API by requiring a valid Azure AD token

Intended Audience



What does offloading security actually mean? It means the built-in APIM is the ability to consume other authentication services, which means you don't have to deploy and maintain your own security layer. You can allow a range of different public identity services, so that your users can connect to your APIM portal. These services can be Azure AD, Azure B2C, Facebook, Google, Microsoft and Twitter accounts can all be used to protect and access your APIM. 

With regards to securing the APIs directly, APIM has some native features to help secure APIs using OpenID Connect or OAuth 2.0. We are going to be working through the process of setting up and securing an API using OAuth 2, and our Azure AD tenant, Cyberlabs.

About the Author

Matthew Quickenden is a motivated Infrastructure Consultant with over 20 years of industry experience supporting Microsoft systems and other Microsoft products and solutions. He works as a technical delivery lead managing resources, understanding and translating customer requirements and expectations into architecture, and building technical solutions. In recent years, Matthew has been focused on helping businesses consume and utilize cloud technologies with a focus on leveraging automation to rapidly deploy and manage cloud resources at scale.