An organization deploys Azure API Management (APIM) as an AI gateway in front of Azure OpenAI Service. The security team wants to enforce that no single application can consume more than 60,000 tokens per minute (TPM) across all Azure OpenAI calls routed through APIM. Which APIM policy implements this token-based rate limiting?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Azure API Management includes a purpose-built 'azure-openai-token-limit' policy that counts the prompt and completion tokens returned in Azure OpenAI responses and enforces a tokens-per-minute (TPM) limit. By setting the counter-key to the calling subscription key (which identifies each application), the policy enforces per-application TPM limits and returns an HTTP 429 response when the limit is exceeded.
Full explanation below image
Full Explanation
B is correct because Azure API Management includes a purpose-built 'azure-openai-token-limit' policy that counts the prompt and completion tokens returned in Azure OpenAI responses and enforces a tokens-per-minute (TPM) limit. By setting the counter-key to the calling subscription key (which identifies each application), the policy enforces per-application TPM limits and returns an HTTP 429 response when the limit is exceeded. This prevents any single application from monopolizing Azure OpenAI capacity. A is wrong because 'rate-limit-by-key' counts API requests (calls per minute), not tokens—an application could stay under the request rate limit while consuming far more tokens per call. C is wrong because 'quota-by-key' sets a total number of calls or bandwidth over a longer time window (weeks/months), not a real-time per-minute token rate limit. D is wrong because 'ip-filter' controls access by source IP, and combining it with a request-based 'rate-limit' still doesn't account for token consumption.