API Management (APIM)

Azure API Management (APIM) is Microsoft's managed API gateway. Sitting in front of Dataverse, Business Central, F&O, and other APIs, APIM adds rate limiting (per-consumer quotas), authentication (subscription keys, OAuth, JWT validation), transformation (request / response shape), caching (reduce backend load), versioning (manage API evolution), observability (every request logged), and a developer portal (auto-generated documentation for consumers). Behaviour is configured through declarative policies in XML. Products group APIs; subscriptions issued to consumers. For enterprise Dynamics 365 integrations with many consumers — partners, internal apps, mobile clients — APIM is the standard governance layer. Tiered pricing (Developer, Basic, Standard, Premium) based on capacity needs.

In practice, APIM earns its cost the moment more than a couple of external consumers depend on the same backend API — instead of every partner integration authenticating and rate-limiting itself independently against Dataverse or Business Central directly, APIM becomes the single choke point that enforces consistent quotas, logs every call for troubleshooting, and can reshape a request or response without touching the backend at all. This is the difference between debugging "which of twelve integrations is hammering our API today" by reading APIM's logs versus having no centralised visibility at all.

Where confusion shows up: APIM's own rate limits and the backend API's own limits (Dataverse's per-user request limits, for instance) are two separate layers that both apply — configuring a generous APIM quota doesn't raise the backend's own ceiling, and a consumer can still get throttled by Dataverse even while comfortably inside their APIM subscription's quota. Policies are also easy to underestimate in complexity: a policy that transforms a request or validates a JWT looks like simple configuration but is genuinely XML-based logic that needs the same testing discipline as code, since a broken policy can silently corrupt every request passing through the gateway.