@Ankit Rathod Thank you for reaching out to us on Q&A. We apologize for the delay in responding to your question.
I understand your concern. You do not need to use APIM if you don’t need to transform inbound/outbound requests going out to/from their APIs. If all you need is WAF, you should be fine with AppGateway => VNET => API on VM scenario.
It should be possible to achieve this using WAFv1 but we highly recommend going with WAFv2 here is a document that explains the difference and why WAFv2 is preferred.
Please let us know if you have any further questions and we will be glad to assist you further. Thank you!
Remember:
Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Want a reminder to come back and check responses? Here is how to subscribe to a notification.