A uvularia-glade SPA already presents an Entra access token for the city API. Which APIM approach validates that caller token at the gateway?
Select an answer to reveal the explanation.
Short Explanation
SPA already has an Entra access token? Validate it with validate-jwt at APIM—subscription key alone is the wrong shape for that uvularia-glade flow.
Full Explanation
When callers present bearer tokens, API Management’s JWT validation policy (validate-jwt) checks issuer, audience, and claims at the gateway. Relying only on a subscription key does not validate the SPA’s Entra token. Storage keys and Logic Apps webhooks are not the APIM access policy for caller JWTs.