Azure Function App: APIM Security Policies – JWT & Rate Limiting

APIM Security Policies for Azure Function App

Overview

Azure API Management (APIM) allows you to enforce security and traffic control on your Function App APIs. Key policies include:

• JWT Validation: Verify tokens from Azure AD or other identity providers to secure your endpoints.
• OAuth 2.0: Authenticate requests using client credentials or authorization code flows.
• Rate Limiting: Control API consumption per subscription or user.
• Caching & Transformation: Improve performance and modify requests/responses as needed.

Step 1: Import Azure Functions into APIM

1. Go to your APIM instance → APIs → Add API → Function App.
2. Select your subscription and Function App.
3. Choose multiple functions to import as API operations.
4. Customize operation names, routes, and descriptions.

Step 2: Apply JWT Validation Policy

JWT (JSON Web Token) validation ensures only authenticated requests reach your API. Steps:

1. Navigate to APIs → Your API → Design → All Operations → Inbound processing.
2. Click Add Policy → Validate JWT.
3. Configure:
• Issuer: e.g., https://login.microsoftonline.com/{tenant-id}/v2.0
• Audience: Your Function App App ID URI.
• OpenID Configuration URL: e.g., https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration
4. Save the policy and test the endpoint with a valid JWT token.

Step 3: Apply Rate Limiting & Throttling

Rate limiting helps protect your backend from overload:

1. In Inbound processing, click Add Policy → Rate Limit by Key.
2. Specify limits, e.g., calls: 100/minute per subscription key.
3. Use Rate Limit by Caller for user-based limits.
4. APIM will return HTTP 429 for requests exceeding the limit.

Step 4: Additional Security Policies

• IP Filtering: Restrict access to specific client IPs.
• CORS: Control cross-origin requests.
• Quota: Set monthly or daily usage limits per subscription.
• Transformation: Modify headers, body, or URLs.

Step 5: Test & Monitor

1. Use the APIM Test console or Postman to send requests.
2. Check that requests with invalid JWTs are blocked.
3. Verify rate limits return HTTP 429 when exceeded.
4. Monitor logs and analytics to track API usage and policy enforcement.

Frequently Asked Questions (FAQ)

1. Can I combine JWT validation with OAuth 2.0?

Yes, you can validate OAuth 2.0 access tokens via the JWT validation policy for additional security.

2. Can I apply rate limits per user or subscription?

Yes, APIM supports rate limiting by subscription key, caller, or custom headers.

3. Do JWT policies work with multiple Function App endpoints?

Yes, you can apply JWT validation globally on the API or per operation.

4. How do I test JWT policies?

Use tools like Postman or the APIM Test console to pass valid and invalid tokens and verify behavior.

5. Where can I find official documentation?

Microsoft official guides: Validate JWT Policy, Rate Limit Policy.