API Management
Tiers · VNet options · Self-hosted gateway · Policies
Practice questions for this topic →
Tier capabilities (from Microsoft's feature comparison)
| Capability | Dev | Basic | Basic v2 | Std | Std v2 | Prem | Prem v2 |
|---|---|---|---|---|---|---|---|
| Scale units | 1 | 2 | 10 | 4 | 10 | 12 per region | 30 |
| Built-in cache | 10 MB | 50 MB | 250 MB | 1 GB | 1 GB | 5 GB | 5 GB |
| Inject into a VNet (fully private) | ✓ | — | — | — | — | ✓ | ✓ |
| Reach backends in a VNet | ✓ | — | — | — | ✓ | ✓ | ✓ |
| Inbound private endpoint | ✓ | ✓ | — | ✓ | ✓ | ✓ | ✓ |
| Multi-region | — | — | — | — | — | ✓ | — |
| Availability zones | — | — | — | — | — | ✓ | ✓ |
| Self-hosted gateway | ✓ | — | — | — | — | ✓ | — |
| Static IP | ✓ | ✓ | — | ✓ | — | ✓ | — |
| Backup and restore | ✓ | ✓ | — | ✓ | — | ✓ | — |
| Workspaces | — | — | ✓ | — | ✓ | ✓ | ✓ |
The Consumption tier scales automatically, has no built-in cache (use an external cache) and no VNet options. The Developer tier is for non-production and has no SLA; Basic v2 is the cheap dev/test tier with an SLA.
Facts to know
- v2 VNet features: Standard v2 and Premium v2 integrate with a VNet so the gateway can reach isolated backends while the gateway stays public. Premium v2 adds simplified VNet injection for full inbound and outbound isolation. The VNet must be in the same region and subscription as the instance.
- Policies (rate limit, quota, validate-jwt, caching) are available in every tier.
- A public API with WAF protection: Application Gateway (WAF) in front of an internal-mode API Management instance.
Exam Tips
Tick each tip once you can answer it without looking.
“API gateway must be completely isolated inside a VNet in production” → APIM Premium or Premium v2 (VNet injection). Trap: Developer also supports injection but has no SLA.
“Only the backends are private; the gateway can be public” → Standard v2 with VNet integration.
“Single APIM instance with gateways in multiple Azure regions” → Premium (classic) multi-region deployment. Trap: Premium v2 doesn't support multi-region.
“Manage APIs hosted on-prem or in other clouds with local gateways” → Self-hosted gateway (Premium).
“Cheapest tier with an SLA for dev/test” → Basic v2. Trap: Developer tier has no SLA.
“Throttle each consumer to N calls per minute” → Rate-limit / quota policies.
“Validate Entra ID tokens before requests reach the backend” → validate-jwt policy.
“Public API needs WAF protection in front of internal-mode APIM” → Application Gateway (WAF) → APIM (internal).
“Scale units per tier” → Developer 1, Basic 2, Standard 4, Basic v2 and Standard v2 10, Premium 12 per region, Premium v2 30. Trap: Consumption scales automatically.
“Static inbound IP address for the gateway” → Classic Developer, Basic, Standard or Premium tiers. Trap: The v2 tiers don't list a static IP.
“Built-in backup and restore” → Classic tiers only (not Basic v2, Standard v2 or Premium v2). Trap: Workspaces are in the v2 tiers and classic Premium.
“VNet for Standard v2 integration or Premium v2 injection” → Same region and subscription as the API Management instance. Trap: Standard v2 keeps the gateway public and reaches VNet backends.