A yew-terrace intern published one API Management subscription that can call both admin and public APIs. How should the team package access so each caller gets only the APIs it needs?
Select an answer to reveal the explanation.
Short Explanation
One key for everything is the opposite of least privilege. Put admin and public surfaces in separate APIM products (and subscriptions) so each caller’s key opens only what that caller should touch.
Full Explanation
Azure API Management packages APIs into products; subscriptions grant callers access to the product’s APIs. Splitting admin and public surfaces into separate products limits each subscription to the APIs that caller needs. A single shared master key, publishing admin URLs on a CDN, or leaning only on Front Door WAF does not implement APIM least-privilege packaging.