Which of the two shared secrets around the Azure API Management gateway can an Entra ID token or a managed identity replace, and what does each new check actually reject? After Part 2, the API trusts a subscription key on the way in and a function key on the way out, and neither one says who is calling. A subscription key that leaks from a partner's config identifies nobody, and the function key works just as well from a laptop as from the gateway, so anyone holding it skips every policy from Part 2. The short answer: the token doesn't replace the subscription key at all, and the managed identity replaces the function key only at the end of a migration.

Checking identity at the gateway means the function code never parses a token, one policy covers every operation of the API, and a rejected call never reaches the Flex Consumption app.…