We have previously discussed how it is possible to organize APIs in products with those products further refined through the use of policies.

Access to and visibility of products is controlled through the use of groups and developer subscriptions for those APIs requiring subscriptions.

In most enterprise scenarios where you are providing access to some line of business system on-premises, it is necessary to provide sufficient security on the API endpoint to ensure that the solution remains compliant.

There are a number of ways to achieve this level of security using Azure API Management, such as using certificates, Azure Active Directory, or extending the corporate network into Microsoft Azure using a Virtual Private Network (VPN), and creating a hybrid cloud solution.