This blog shows how to use Azure API Management to expose the app services APIs called by the claim exchanger Azure function described in the blog from below:

Fig 1 - Add the APIs to the API Management instance

Fig 2 - Add policies to each function

Fig 3 - Add an IP Filter policy to allow just the calls coming from your STS

Fig 4 - The IP policy I have added above prevents calls from my local IP address
Comments