The gateway validates and the backend re-checks. API Management is defence in depth, never the authority: a service reachable only through the gateway today becomes reachable another way tomorrow.
On-behalf-of is used where a downstream call must carry the user's identity, so the audit trail names a person rather than a service. Service-to-service calls with no user context use the workload's own identity instead.
The database is reached with a managed identity and a row-level security context. No connection string and no client secret appears anywhere in this flow.
Numbers
p95 added latency at the gateway is about 8 ms with OIDC metadata and JWKS cached; the first request after a cache expiry costs roughly 120 ms.
Token lifetime one hour, JWKS cache 24 hours, OpenID configuration cache 1 hour. These three values decide how fast an emergency key rotation propagates.
Quota and rate limits are keyed by tenant, so one tenant's traffic spike cannot consume another tenant's allowance.
Risks
Backends that trust a gateway-injected header rather than re-validating the token. Prevented by a contract test in the pipeline, because it cannot be prevented by documentation.
On-behalf-of adds a synchronous dependency on Entra inside the request path. Downstream tokens are cached for their lifetime, and the fallback is a degraded read-only response rather than a failure.
Long-lived refresh tokens held by public clients. Mitigated with PKCE, short-lived access tokens and CAE; eliminating them entirely would break offline mobile use.
