APIs Evolved. Did Your Approach?
Elliott Leighton-Woodruff
Principal Architect | Azure SME | Digital Transformation Lead
APIs are the Backbone of Modern Applications
Every product, internal tool, and mobile app relies on them. They are the glue that holds systems together. Yet despite this, a lot of businesses are still exposing APIs in Azure like it is 2015. And that gap is only getting more dangerous.
Too often, the same pattern shows up: APIs spun up on ageing IIS servers or dropped into Azure App Services without much thought. Maybe there is a basic firewall rule or an IP restriction, if you are lucky. More often, there is no proper API gateway, no consistent authentication, and no real visibility.
If that sounds familiar, you are not just missing an opportunity. You are taking unnecessary risks that will come back to bite you, either when an audit lands or when someone decides to test your perimeter.
The Old Way: Endpoint-Centric Thinking
Traditionally, API security and configuration lived at the endpoint. You would:
It was simple. And for a while, it worked. But simple does not scale, and it certainly does not secure your environment properly.
When your API security is tied to individual servers, app services, or VMs, you are stuck doing the same work over and over. Every new service means more certificates, more configuration tweaks, and more manual checks. You are betting that every engineer gets it right, every time. You are hoping no one forgets to lock down an endpoint.
In 2025, that approach is no longer good enough. The risks are bigger, the pace of change is faster, and the expectations are higher.
The Better Way: Shift API Security to the Gateway
This is where Azure API Management (APIM) comes in.
Instead of hardening every endpoint individually, you put your APIs behind a central, controlled gateway. With Azure APIM, you can:
You shift security and control to where it should be. The API gateway becomes your front door. Your backend services stay lean, focused, and free from unnecessary security plumbing.
Why It Matters
One of the often overlooked benefits of moving to Azure API Management is the visibility you gain by integrating it with Application Insights.
Link APIM to App Insights and you can:
Instead of guessing what is happening at the edge of your platform, you can see it clearly and act on it. And it is not just about security. You can:
The reality is, most organisations are adding APIs faster than they are securing them. Every new API exposed without a gateway is another risk you have not uncovered yet.
Final Thoughts
If you are still exposing APIs directly from App Services, IIS, or unmanaged VMs in Azure, it is time to rethink it.
Start small. Set up an API Management instance. Front a couple of APIs with it. Learn how policies work, how transformations can simplify your services, and how much easier life becomes when your security controls live in one place.
This is not about slowing teams down. It is about giving them the right foundation to move faster, safer, and with more confidence.
If your API security strategy still looks like it did five years ago, now is the time to change it.