Azure apim

Question

This page is where I write the APIM endpoint into the web app environment variables, and the backend of APIM is Azure OpenAI, with relevant token quota restrictions. Accessing the web app using AAD login still results in a 401 error. Should I write code into my application?

<policies>

<inbound>

    <base />

    <!-- 设置后端服务-->

    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid." require-scheme="Bearer" output-token-variable-name="jwt">

        <openid-config url="https://login.microsoftonline.com/common/.well-known/openid-configuration" />

    </validate-jwt>

    <set-backend-service id="apim-generated-policy" backend-id="likxaitest1-ai-endpoint" />

    <set-variable name="userUpn" value="@(context.Request.Headers.GetValueOrDefault("Authorization", string.Empty).AsJwt()?.Claims.GetValueOrDefault("upn") ?? "anonymous")" />

    <!-- 调试用头，可去掉 -->

    <set-header name="X-User-Upn" exists-action="override">

        <value>@((string)context.Variables["userUpn"])</value>

    </set-header>

    <!-- 特定用户限制  -->

    <choose>

        <when condition="@((string)context.Variables["userUpn"] == "******@xxxx.onmicrosoft.com")">

            <llm-token-limit remaining-quota-tokens-header-name="remaining-tokens" tokens-per-minute="10000" token-quota="1000" token-quota-period="Daily" counter-key="@((string)context.Variables["userUpn"])" estimate-prompt-tokens="true" tokens-consumed-header-name="consumed-tokens" />

        </when>

        <otherwise>

            <!-- 其它用户不限制/可自定义限制 -->

            <llm-token-limit remaining-quota-tokens-header-name="remaining-tokens" tokens-per-minute="10000" token-quota="300" token-quota-period="Hourly" counter-key="@((string)context.Variables["userUpn"])" estimate-prompt-tokens="true" tokens-consumed-header-name="consumed-tokens" />

        </otherwise>

    </choose>

</inbound>

<backend>

    <base />

</backend>

<outbound>

    <base />

</outbound>

<on-error>

    <base />

</on-error>

</policies>