Azure API Management | Application Gateway

Question

When we have Azure API Management which could do the traffic management, load balancing (scale out), filtering through policies, managing custom domains and the networking. What is the purpose of having Application Gateway over APIM? Thanks!

Answer 1

Both Azure API Management (APIM) and Azure Application Gateway provide different capabilities, and while there is some overlap (e.g., traffic management), they are optimized for distinct use cases.

Aspect	Azure API Management (APIM)	Azure Application Gateway
Primary Focus	API lifecycle management (publishing, securing, monitoring APIs)	Layer 7 (HTTP/HTTPS) load balancing and application-level routing
Traffic Management	Manages traffic for API calls with quotas, rate limits, and throttling	Balances traffic for web applications or backend pools
Security and Authentication	OAuth, JWT, subscription keys, IP filtering for APIs	WAF (Web Application Firewall), DDoS protection for web apps
Routing	Routes based on API paths, versions, and policies	Routes based on URL paths, host headers, and load balancing rules
Scaling	Manages API scaling by adding more API instances	Scales backend pools or web applications based on demand
Custom Domains	Supports custom domains for APIs	Manages custom domains for web apps with certificates

The reasons for using Application Gateway over APIM

1. Layer 7 Load Balancing for Web Applications
   • Application Gateway is designed for distributing traffic among multiple instances of a web application running in the backend (e.g., VMs, App Services, Kubernetes).
   • It offers session affinity (sticky sessions) and supports SSL termination, which APIM does not focus on.
2. Web Application Firewall (WAF) Integration
   • Application Gateway has built-in WAF capabilities to inspect and block malicious web traffic (e.g., SQL injection, XSS attacks).
   • APIM policies can restrict access (e.g., IP filtering), but they don’t offer comprehensive security like WAF for a web app.
3. Advanced URL-Based Routing
   • Application Gateway allows URL path-based routing for backend web applications, such as:
   • /api/* → App Service
   • /static/* → Blob Storage
   • /auth/* → External Service
   • APIM focuses on API paths, but Application Gateway provides broader routing for web application components.
4. Handling Non-API Traffic
   • Application Gateway can handle both API traffic and non-API traffic, such as static web pages, frontend websites, and other services.
   • APIM is limited to API management only.
5. Network-Level Integration
   • Application Gateway can operate in Virtual Network configurations to expose backend services privately, with features like:
   • Private Link
   • WebSockets support
   • APIM can integrate with VNet, but it’s more focused on API exposure rather than network-level load balancing and traffic management.

Sometimes you might want to combine the two. For example, you might have multiple APIs exposed via APIM but also need load balancing and WAF for frontend web traffic or static content.

• Use APIM for managing API traffic, rate limiting, and versioning.
• Use Application Gateway to balance traffic for the frontend web application and protect it with a WAF.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

@KL Thanks for reaching out. Using Application Gateway in front of API Management adds an extra layer of protection and security. It allows you to selectively expose external APIs while keeping others internal, manage complex web applications, and protect your public IP address. The WAF in Application Gateway can protect against the most common web vulnerabilities.

By deploying Application Gateway in front of API Management, you can have both internal and external consumers go through the same front end, ensuring that all APIs are managed only from within your virtual network. This setup helps in maintaining a consistent security posture and simplifies the management of API traffic

refer: https://techcommunity.microsoft.com/t5/azure-paas-blog/integrating-api-management-with-app-gateway-v2/ba-p/1241650

do let me know incase of further queries, I would be happy to assist you.