A yew-terrace intern published one API Management subscription that can call both admin and public APIs. How should the team package access so each caller gets only the APIs it needs?

Azure API Management packages published APIs into products, and subscriptions grant callers access only to the APIs included in the product they subscribe to. For the yew-terrace municipal surface that mixes admin and public operations, the correct packaging is to put admin APIs in one product and public APIs in another (or finer-grained products per caller class). Each municipal app then receives a subscription key scoped to the product it needs, which is the least-privilege model APIM is designed for.

Sharing one master subscription key across every municipal app fails least privilege at the root: every caller can invoke every API the product exposes, and a year-end rotation schedule does not shrink that blast radius when a key leaks from any single app.

Publishing backend admin URLs on a public CDN fails because it removes the gateway packaging model entirely. Callers would bypass products and subscriptions, and admin endpoints would be discoverable without APIM access control.

Disabling products and relying only on Front Door WAF fails the concept: WAF protects against common web attacks and rate anomalies at the edge, but it is not APIM product-and-subscription packaging. Least privilege for which callers may invoke which APIs is still expressed through APIM products and subscriptions.

Exam caveat: a product can include multiple APIs, and a subscription is typically tied to a product—do not assume one global key equals one API. Operational check: in the APIM portal or via ARM/Bicep, confirm separate products for admin versus public, create distinct subscriptions per caller class, and verify that a public-app key cannot call an admin operation.