How to Secure Azure API Management with OAuth 2.0
You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?
Quick Answer
The correct answer is to configure OAuth 2.0 in Azure API Management, use the validate-jwt policy to restrict access to specific Azure AD applications, and add rate-limit and ip-filter policies. This works because Azure API Management acts as a gateway that can validate OAuth 2.0 tokens at the inbound processing stage, and the validate-jwt policy allows you to check the token’s issuer, audience, and specific claims—such as the application ID—to ensure only authorized Azure AD apps can call your APIs. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how to combine authentication, authorization, and traffic control using built-in policies rather than external services. A common trap is choosing API keys or client certificates, but the question explicitly requires OAuth 2.0, making those options incorrect because they don’t meet the token-based authentication requirement. Memory tip: think “JWT, Rate, IP” as the three policy pillars for securing APIs with OAuth.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies
It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps. Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up client certificate authentication and map certificates to Azure AD apps
Why it's wrong here
Client certificates are not OAuth 2.0.
- ✗
Enable API key authentication and restrict access using subscription keys
Why it's wrong here
API keys are not OAuth 2.0.
- ✗
Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs
Why it's wrong here
This is part of the solution but does not include rate limiting or IP filtering explicitly.
- ✓
Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies
Why this is correct
This combination meets all requirements.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)
easy- ✓ A.Implement OAuth 2.0 authorization with Microsoft Entra ID.
- B.Use client certificates for authentication.
- C.Enable Cross-Origin Resource Sharing (CORS).
- D.Restrict access by IP address only.
- ✓ E.Require subscription keys for all API calls.
Why A: The correct answers are A and E. OAuth 2.0 with Microsoft Entra ID (A) provides delegated authorization, allowing API Management to validate tokens and restrict access based on permissions. Subscription keys (E) offer a simple authentication mechanism by requiring a unique key in each API call. Option B (client certificates) is for mutual TLS authentication, which is not a primary method for typical API access. Option C (CORS) controls cross-origin requests but does not authenticate callers. Option D (IP address restriction) limits access by network location but is not an authentication method.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.