Hotspot Question Your company has 20 web APIs that were developed in-house. The company is developing 10 web apps that will use the web APIs. The web apps and the APIs are registered in the company…

Question

Exhibit

Answer Area

• Grant permissions to allow the web apps to access the web APIs by using:
  Azure ADAzure API ManagementThe web APIs
• Configure a JSON Web Token (JWT) validation policy by using:
  Azure ADAzure API ManagementThe web APIs

Explanation

Explanation

Dropdown 1: Grant permissions to allow web apps to access web APIs by using Azure AD

Why Azure AD is correct: Azure AD is the identity platform where both the web apps and web APIs are registered. You expose API scopes (permissions) on the API app registration, then grant the web app app registrations delegated or application permissions to those scopes. When a web app authenticates, Azure AD embeds the granted scopes as claims (scp or roles) inside the issued JWT. This is the source of the "Azure AD-generated claims" the requirement specifies.

Why the alternatives are wrong:

• Azure API Management: APIM is a gateway - it validates tokens but does not manage OAuth 2.0 permission grants or issue tokens. It has no concept of "granting" access between app registrations.
• The web APIs: The backend APIs themselves do not manage permissions. They receive and optionally validate tokens, but the authority for what permissions exist lives in Azure AD.

Dropdown 2: Configure a JWT validation policy by using Azure API Management

Why Azure API Management is correct: APIM has a built-in inbound validate-jwt policy. You configure it once per API (or globally) to require a valid JWT issued by your Azure AD tenant, with specific audiences and required claims. Unauthorized requests are rejected at the gateway - they never reach the backend. This satisfies both requirements:

• Uses Azure AD-generated claims (the JWT issued by Azure AD).
• Minimizes effort - you configure it centrally in APIM across all 20 APIs rather than modifying each API's code.

Why the alternatives are wrong:

• Azure AD: Azure AD issues JWTs, it doesn't host a "validation policy" you apply to API traffic. It's not in the request path between web apps and your APIs.
• The web APIs: You could add JWT validation logic inside each of the 20 APIs, but that violates the "minimize configuration and management effort" requirement - it means 20 separate implementations to build, maintain, and update.

Core concept summary

APIM acts as a centralized enforcement point, and Azure AD acts as the identity authority - together they form the recommended pattern for securing APIs with minimal backend changes.

No community discussion yet for this question.