Question
Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service.
Contoso establishes a partnership with another company named Fabrikam, Inc.
Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users.
Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso.
You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements:
✑ Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso.
✑ The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.
✑ The solution must NOT require changes to the logic apps.
✑ The solution must NOT use Azure AD guest accounts.
What should you include in the solution?
- A. Azure Front Door
- B. Azure AD Application Proxy
- C. Azure AD business-to-business (B2B)
- D. Azure API Management Correct
Explanation
Azure API Management (APIM) can be placed in front of the logic apps' HTTP triggers without changing the logic apps. APIM can validate OAuth 2.0 tokens issued by Fabrikam's third-party identity provider (validate-jwt policy), so no Azure AD tenant or guest accounts are needed, and products/subscriptions with rate-limit or quota policies let the Fabrikam developers be throttled to lower rates than Contoso users. Front Door, Azure AD Application Proxy and Azure AD B2B do not provide per-consumer rate limiting with a third-party OAuth provider.
