Merge pull request #215170 from dlepow/faq

[APIM] FAQ refresh/update

Author: Court72

articles/api-management/api-management-faq.yml

@@ -1,27 +1,19 @@
 ### YamlMime:FAQ
 metadata:
-  title: Azure API Management FAQ | Microsoft Docs
-  description: Learn the answers to frequently asked questions (FAQ), patterns, and best practices in Azure API Management.
+  title: Azure API Management FAQs | Microsoft Docs
+  description: Learn the answers to frequently asked questions (FAQs) about Azure API Management.
   services: api-management
   documentationcenter: ''
   author: dlepow
-  manager: erikre
-  editor: ''
 
-  ms.assetid: 2fa193cd-ea71-4b33-a5ca-1f55e5351e23
   ms.service: api-management
-  ms.workload: mobile
-  ms.tgt_pltfrm: na
   ms.topic: faq
-  ms.date: 11/19/2017
+  ms.date: 10/24/2022
   ms.author: danlep 
-  ms.custom: devx-track-azurepowershell, fasttrack-edit
+  ms.custom: engagement-fy23,fasttrack-edit
 title: Azure API Management FAQs
 summary: |
-  Get the answers to common questions, patterns, and best practices for Azure API Management.
-  
-  [!INCLUDE [updated-for-az](../../includes/updated-for-az.md)]
-  
+  Get the answers to common questions about Azure API Management.
 
 sections:
   - name: Ignored
@@ -32,123 +24,112 @@ sections:
           When a feature is in preview, it means that we're actively seeking feedback on how the feature is working for you. A feature in preview is functionally complete, but it's possible that we'll make a breaking change in response to customer feedback. We recommend that you don't depend on a feature that is in preview in your production environment.
 
       - question: |
-          How can I secure the connection between the API Management gateway and my back-end services?
+          How do I find out about updates and changes to API Management?
         answer: |
-          You have several options to secure the connection between the API Management gateway and your back-end services. You can:
+          Subscribe to update announcements published in these locations:
           
-          * Use HTTP basic authentication. For more information, see [Import and publish your first API](import-and-publish.md).
-          * Use TLS mutual authentication as described in [How to secure back-end services by using client certificate authentication in Azure API Management](api-management-howto-mutual-certificates.md).
-          * Use IP filtering on your back-end service. In all tiers of API Management with the exception of Consumption tier, the IP address of the gateway remains constant, with a few caveats described in [the IP documentation article](api-management-howto-ip-addresses.md).
-          * Connect your API Management instance to an Azure Virtual Network.
+          * [Azure API Management release notes](https://github.com/Azure/API-Management/releases).
+          * [Azure updates](https://azure.microsoft.com/updates/?query=%22API%20Management%22)
           
       - question: |
-          How do I copy my API Management service instance to a new instance?
+          How can I secure the connection between the API Management gateway and my backend services?
         answer: |
-          You have several options if you want to copy an API Management instance to a new instance. You can:
+          You have several options to secure the connection between the API Management gateway and your backend services, including:
           
-          * Use the backup and restore function in API Management. For more information, see [How to implement disaster recovery by using service backup and restore in Azure API Management](api-management-howto-disaster-recovery-backup-restore.md).
-          * Create your own backup and restore feature by using the [API Management REST API](/rest/api/apimanagement/). Use the REST API to save and restore the entities from the service instance that you want.
-          * Download the service configuration by using Git, and then upload it to a new instance. For more information, see [How to save and configure your API Management service configuration by using Git](api-management-configuration-repository-git.md).
+          * Use subscription key authentication. For more information, see [Import and publish your first API](import-and-publish.md).
+          * Use TLS mutual authentication as described in [How to secure back-end services by using client certificate authentication in Azure API Management](api-management-howto-mutual-certificates.md).
+          * Use IP filtering on your back-end service. In all tiers of API Management except the Consumption tier, the IP address of the gateway remains constant. For more information, see [IP addresses of Azure API Management](api-management-howto-ip-addresses.md).
+          * Connect your API Management instance to an [Azure virtual network](virtual-network-concepts.md).
+          * Configure OAuth 2.0 authorization. For more information, see [Authentication and authorization in API Management](authentication-authorization-overview.md).        
+
+      - question: |
+          How do I copy my API Management service instance to a new instance?
+        answer: |
+          You have several options, including:
           
+          * Use the [backup and restore](api-management-howto-disaster-recovery-backup-restore.md) functionality in API Management.
+          * Create your own backup and restore feature by using the [API Management REST API](/rest/api/apimanagement/) to save and restore the entities from the service instance that you want.
+          * Download the service configuration by using [Git](api-management-configuration-repository-git.md), and then upload it to a new instance.
+      
+      - question: |
+          Can I move an API Management instance from one subscription to another?
+        answer: |
+          Yes. To learn how, see [Move resources to a new resource group or subscription](../azure-resource-manager/management/move-resource-group-and-subscription.md).
+
       - question: |
           Can I manage my API Management instance programmatically?
         answer: |
-          Yes, you can manage API Management programmatically by using:
-          
-          * The [API Management REST API](/rest/api/apimanagement/).
-          * The [Microsoft Azure ApiManagement Service Management Library SDK](https://aka.ms/apimsdk).
-          * The [Service deployment](/powershell/module/wds) and [Service management](/powershell/azure/servicemanagement/overview) PowerShell cmdlets.
+          Yes, you can manage API Management programmatically by using a variety of tools, including:
           
+          * The [API Management REST API](/rest/api/apimanagement/)
+          * Azure client SDKs for [.NET](/dotnet/api/overview/azure/apimanagement), [JavaScript](/javascript/api/overview/azure/api-management), [Java](/java/api/overview/azure/api-management), and other languages
+          * [Azure PowerShell](/powershell/module/az.apimanagement/) and [Azure CLI](/cli/azure/apim)
+          * [Azure Resource Manager](/azure/templates/microsoft.apimanagement/allversions) and Bicep templates. See example [quickstart templates](https://azure.microsoft.com/resources/templates/?Page=2&term=api+management).
+          * [Terraform](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/api_management)
+
       - question: |
           How do I add a user to the Administrators group?
         answer: |
-          Administrators group is an immutable system group. Azure subscription administrators are members of this group. You can't add a user to this group. See [How to create and use groups to manage developer accounts in Azure API Management](./api-management-howto-create-groups.md) for more information. 
+          Administrators group is an immutable system group that includes Azure subscription administrators. You can't add a user to this group. For more information, see [How to create and use groups to manage developer accounts in Azure API Management](./api-management-howto-create-groups.md). 
           
-          You can change the administrator [email settings](api-management-howto-configure-notifications.md#configure-email-settings) that are used in notifications sent to developers from your API Management instance.
       - question: |
           Why is the policy that I want to add unavailable in the policy editor?
         answer: |
-          If the policy that you want to add appears dimmed or shaded in the policy editor, be sure that you are in the correct scope for the policy. Each policy statement is designed for you to use in specific scopes and policy sections. To review the policy sections and scopes for a policy, see the policy's Usage section in [API Management policies](./api-management-policies.md).
-          
+          If the policy that you want to add appears greyed or shaded in the policy editor, be sure that you are in the correct scope for the policy. Each policy statement is designed for use in specific [scopes and policy sections](api-management-howto-policies.md). To review the policy sections and scopes for a policy, see the policy's Usage section in the [policy reference](./api-management-policies.md).
+
       - question: |
           How do I set up multiple environments in a single API?
         answer: |
           To set up multiple environments, for example, a test environment and a production environment, in a single API, you have two options. You can:
           
-          * Host different APIs on the same tenant.
-          * Host the same APIs on different tenants.
-          
-      - question: |
-          Can I use SOAP with API Management?
-        answer: |
-          [SOAP pass-through](https://azure.microsoft.com/blog/soap-pass-through/) support is now available. Administrators can import the WSDL of their SOAP service, and Azure API Management will create a SOAP front end. Developer portal documentation, test console, policies and analytics are all available for SOAP services.
-          
-      - question: |
-          Can I configure an OAuth 2.0 authorization server with AD FS security?
-        answer: |
-          To learn how to configure an OAuth 2.0 authorization server with Active Directory Federation Services (AD FS) security, see [Using ADFS in API Management](https://phvbaars.wordpress.com/2016/02/06/using-adfs-in-api-management/).
+          * Host different APIs on the same API Management instance.
+          * Host the same APIs on different instances.
           
       - question: |
-          What routing method does API Management use in deployments to multiple geographic locations?
+          Does API Management only support REST API backends?
         answer: |
-          API Management uses the [performance traffic routing method](../traffic-manager/traffic-manager-routing-methods.md#performance) in deployments to multiple geographic locations. Incoming traffic is routed to the closest API gateway. If one region goes offline, incoming traffic is automatically routed to the next closest gateway. Learn more about routing methods in [Traffic Manager routing methods](../traffic-manager/traffic-manager-routing-methods.md).
-          
+          API Management supports REST APIs as well as passthrough to [SOAP](import-soap-api.md), [WebSocket](websocket-api.md), and [GraphQL](graphql-api.md) APIs. API Management also supports [synthetic GraphQL](graphql-schema-resolve-api.md) APIs.
+
+          API Management also integrates with Azure compute offerings commonly used for building and hosting APIs on Azure, including [Functions](import-function-app-as-api.md), [Logic Apps](import-logic-app-as-api.md), [Container Apps](import-container-app-with-oas.md), and [Web Apps](import-app-service-as-api.md).
+
       - question: |
-          Can I use an Azure Resource Manager template to create an API Management service instance?
+          Are there restrictions on importing my API?
         answer: |
-          Yes. See the [Azure API Management Service](https://azure.microsoft.com/resources/templates/azure-api-management-create/) quickstart templates.
-          
+          See [API import restrictions and known issues](api-management-api-import-restrictions.md) for OpenAPI (Swagger), WSDL, and WADL formats.
+                    
       - question: |
-          Can I use a self-signed TLS/SSL certificate for a back end?
+          Can I use CI/CD for API development?
         answer: |
-          Yes. This can be done through PowerShell or by directly submitting to the API. This will disable certificate chain validation and will allow you to use self-signed or privately-signed certificates when communicating from API Management to the back end services.
-          
-          ### PowerShell method
-          Use the [`New-AzApiManagementBackend`](/powershell/module/az.apimanagement/new-azapimanagementbackend) (for new back end) or [`Set-AzApiManagementBackend`](/powershell/module/az.apimanagement/set-azapimanagementbackend) (for existing back end) PowerShell cmdlets and set the `-SkipCertificateChainValidation` parameter to `True`.
-          
-          ```powershell
-          $context = New-AzApiManagementContext -resourcegroup 'ContosoResourceGroup' -servicename 'ContosoAPIMService'
-          New-AzApiManagementBackend -Context  $context -Url 'https://contoso.com/myapi' -Protocol http -SkipCertificateChainValidation $true
-          ```
-          ### Direct API update method
-       
-          1. Create a [Backend](/rest/api/apimanagement/) entity by using API Management.		
-          2. Set the **skipCertificateChainValidation** property to **true**.		
-          3. If you no longer want to allow self-signed certificates, delete the Backend entity, or set the **skipCertificateChainValidation** property to **false**.
-          
+          Yes. For more information, see [Use DevOps and CI/CD to publish APIs](devops-api-development-templates.md).
+
+          For architectural guidance, see [Azure API Management landing zone accelerator](/azure/cloud-adoption-framework/scenarios/app-platform/api-management/landing-zone-accelerator).     
+      
       - question: |
-          Why do I get an authentication failure when I try to clone a Git repository?
+          What routing method does API Management use in deployments to multiple geographic locations?
         answer: |
-          If you use Git Credential Manager, or if you're trying to clone a Git repository by using Visual Studio, you might run into a known issue with the Windows credentials dialog box. The dialog box limits password length to 127 characters, and it truncates the Microsoft-generated password. We are working on shortening the password. For now, please use Git Bash to clone your Git repository.
-
+          API Management uses the [performance traffic routing method](../traffic-manager/traffic-manager-routing-methods.md#performance) (lowest latency) in deployments to multiple geographic locations. For more information, see [Deploy an Azure API Management instance to multiple Azure regions](api-management-howto-deploy-multi-region.md).
+           
       - question: |
           Does API Management work with Azure ExpressRoute?
         answer: |
-          Yes. API Management works with Azure ExpressRoute.
+          Yes. 
 
       - question: |
-          Why do we require a dedicated subnet in Resource Manager style VNETs when API Management is deployed into them?
-        answer: |
-          The dedicated subnet requirement for API Management comes from the fact, that it is built on Classic (PAAS V1 layer) deployment model. While we can deploy into a Resource Manager VNET (V2 layer), there are consequences to that. The Classic deployment model in Azure is not tightly coupled with the Resource Manager model and so if you create a resource in V2 layer, the V1 layer doesn't know about it and problems can happen, such as API Management trying to use an IP that is already allocated to a NIC (built on V2).
-          To learn more about difference of Classic and Resource Manager models in Azure refer to [difference in deployment models](../azure-resource-manager/management/deployment-models.md).
-          
-      - question: |
-          What is the minimum subnet size needed when deploying API Management into a VNET?
+          What is the minimum subnet size needed when deploying API Management into a VNet?
         answer: |
-          The minimum subnet size needed to deploy API Management is [/29](../virtual-network/virtual-networks-faq.md#configuration), which is the minimum subnet size that Azure supports.
-          
+          The minimum subnet size needed to deploy API Management is /29. Learn more about using API Management in [virtual networks](virtual-network-concepts.md).
+
       - question: |
-          Can I move an API Management service from one subscription to another?
+          Does API Management provide a web application firewall (WAF)?
         answer: |
-          Yes. To learn how, see [Move resources to a new resource group or subscription](../azure-resource-manager/management/move-resource-group-and-subscription.md).
-          
+          While API Management doesn't include a WAF component, deploying a WAF upstream (in front) of the API Management instance is recommended. For example, use [Azure Application Gateway](api-management-howto-integrate-internal-vnet-appgateway.md) or [Azure Front Door](front-door-api-management.md).
       - question: |
-          Are there restrictions on or known issues with importing my API?
+          What are the differences between the managed gateway and the self-hosted gateway?
         answer: |
-          [Known issues and restrictions](api-management-api-import-restrictions.md) for Open API(Swagger), WSDL and WADL formats.
-                
+          For information, see [API gateway in API Management](api-management-gateways-overview.md) and the [Self-hosted gateway overview](self-hosted-gateway-overview.md).
+
       - question: |
           How does API Management handle trailing slashes when calling backend services?
         answer: |
-          Historically and by convention a URL ending with a trailing slash is treated as a Directory, for example "https://contoso.com/sample/" whereas the same URL without the trailing slash "https://contoso.com/sample" would be indicative of a file. This is not mandated, so some systems will consider those two URLs unique, whilst others will consider them the same URL. API Management doesn’t make a distinction thus a single operation "resource" will accept "resource" and "resource/". However, whilst the distinction doesn’t matter to API Management it may matter to the backend host. Some web servers will automatically redirect a URL not ending with a trailing slash, to the same URL ending in a trailing slash. As API Management is the client to the backend (server) an automatic redirect is not always desirable. If needed create a [Rewrite URL policy](api-management-transformation-policies.md#RewriteURL) to ensure a trailing slash is always added to the outbound backend call.
+          Historically and by convention a URL ending with a trailing slash is treated as a directory, for example `https://contoso.com/sample/` whereas the same URL without the trailing slash `https://contoso.com/sample` would indicate a file. This isn't mandated; some systems consider those two URLs unique, others consider them the same. API Management doesn’t make a distinction, thus a single operation `resource` will accept either `resource` or `resource/`. However, the distinction may matter to the backend host. Some web servers will automatically redirect a URL not ending with a trailing slash, to the same URL ending in a trailing slash. As API Management is the client to the backend (server), an automatic redirect isn't always desirable. If needed, create a [Rewrite URL policy](api-management-transformation-policies.md#RewriteURL) to ensure a trailing slash is always added to the outbound backend call.