The lock-status API in Azure API Management is protected only by a subscription key passed in the query string. What should the security engineer recommend for stronger inbound authentication?
Select an answer to reveal the explanation.
Short Explanation
A subscription key in the URL is like a paper ticket anyone can photocopy. Make callers show an Entra JWT—validate-azure-ad-token or validate-jwt—and treat the key as a tracking stub, not the whole gate.
Full Explanation
Azure API Management inbound policies can validate Microsoft Entra tokens (validate-azure-ad-token) or generic JWTs (validate-jwt), which provides identity-based API authentication beyond a shared subscription key. Subscription keys remain useful for product metering and throttling but should not be the sole gate when stronger auth is required. Relocating a static key into named values without token validation does not fix the trust model. Full policy XML authoring depth is out of scope for this recommend-security item.