Azure AI Gateway Governance
Use Azure API Management to govern traffic across AI models, MCP tools, and agents.
The documentation recommends managed identities, Azure RBAC, and scoped authorization, and distinguishes local from production credentials. However, examples perform external changes such as backend creation, role assignment, API import, and gateway calls without explicit confirmation, rollback guidance, or clear data-flow/logging sensitivity disclosure. It also exposes subscription-key and built-in all-access tracing procedures, so points are deducted.
Structured patterns, troubleshooting, and health checks cover common paths and provide some failure feedback. However, the skill depends on Azure CLI, APIM/Azure resources, and specific API or policy versions; it contains no skill-specific executable tests, and command or compatibility correctness cannot be confirmed statically. The score therefore remains below the static-review ceiling.
Triggers, model/tool/agent governance scenarios, and several prerequisites are reasonably clear. Non-fit boundaries, input/output contracts, trigger exclusions, and environment limits are incomplete. There is no Chinese-language guidance or explicit assessment of mainland-China reachability for Azure, Microsoft Learn, or GitHub raw-spec dependencies, so points are deducted.
The documentation is layered into quick reference, common tasks, troubleshooting, and references, and includes MIT licensing plus author and version 3.1.1 metadata. It lacks a changelog, explicit maintenance owner/update path, dependency version pinning, and a complete FAQ, while risks from changing external references are not managed, so points are deducted.
The skill covers APIM AI-gateway backends, policies, caching, rate limiting, content safety, metrics, streaming, and multi-tenancy, with reusable CLI, XML, and curl examples. Placeholder values, deployment prerequisites, and unverified service compatibility still require environment-specific adaptation and review; static calibration limits the score.
It supplies traceable Microsoft Learn, Azure Samples, SDK, and API-spec references, along with diagnostic commands and health-check examples. However, there are no skill-specific committed tests, execution results, or independent corroboration, so the score is limited to the static-evidence ceiling.
- Obtain explicit user confirmation before running az commands, assigning roles, importing APIs, or changing gateway policies, and prepare an auditable rollback plan.
- Do not expose subscription keys in logs, prompts, or shared output; restrict built-in all-access subscriptions to tightly isolated diagnostic use.
- Validate policy elements, CLI arguments, streaming compatibility, retry behavior, APIM SKU, and API versions in the target Azure environment.
- Core operation depends on Azure CLI, Azure resources, and external Microsoft/GitHub services; mainland-China reachability and offline alternatives are not documented.
What does this skill do, and when should you use it?
The Azure AI Gateway skill guides users in configuring Azure API Management as a gateway for AI models, MCP tools, and agents. It covers semantic caching, token limits, load balancing, content safety, jailbreak detection, token metrics, and backend authentication. The skill includes Azure CLI commands, a curl-based endpoint test, and a recommended APIM policy order. It is a good fit for Azure teams that already have, or plan to provision, APIM; it does not deploy APIM itself.
It uses Azure CLI to retrieve the APIM gateway URL, list AI backends, and obtain subscription keys. It shows how to create an Azure OpenAI backend and grant APIM's managed identity the Cognitive Services User role. It provides a curl example for calling an OpenAI chat completions endpoint through the gateway and explains how to combine authentication, semantic cache lookup, token limits, content safety, backend selection, and metrics policies. It also covers MCP or tool rate limiting, API-to-MCP conversion, and troubleshooting for token-limit 429 responses, cache misses, content false positives, and backend 401 errors.
- An Azure platform engineer needs to add an Azure OpenAI or AI Foundry model as an APIM backend.
- A cost-conscious AI team wants token limits, semantic caching, and token metrics for model usage control.
- An MCP tool developer needs per-key rate limiting to protect tool endpoints.
- An agent operations team needs content-safety filtering and jailbreak detection at the gateway.
- An engineer needs to validate that APIM correctly forwards OpenAI requests and wants a CLI-plus-curl test path.
What are this skill's strengths and limitations?
- Addresses governance for models, tools, and agents in one skill.
- Includes copyable Azure CLI, curl, and policy-order examples.
- Covers concrete controls for token usage, caching, safety, rate limiting, and observability.
- Provides troubleshooting guidance for several common gateway failures.
- Requires Azure CLI and access to appropriately configured Azure resources and permissions.
- Does not deploy APIM; deployment is handled by the separate azure-prepare skill.
- The source provides no evidence of an independent test suite, support for other cloud platforms, or a non-Azure-CLI configuration path.
- The stated 60%–80% semantic-cache cost saving is a documentation claim, not a guarantee for every workload.
How do you install this skill?
To install the collection, run: npx skills add microsoft/skills, then select the required skills in the wizard. With Copilot CLI, the README also documents: /plugin marketplace add microsoft/skills and /plugin install azure-skills@skills. The source does not document a standalone installation procedure for .github/plugins/azure-skills/skills/azure-aigateway.
How do you use this skill?
After installing the skill in an Agent Skills-compatible client, use prompts such as “add an Azure OpenAI backend to my APIM,” “configure rate limiting for my MCP tool,” “enable semantic caching and token metrics,” or “test my AI gateway.” Azure CLI is required for the configuration and testing examples. APIM deployment is delegated to the azure-prepare skill. A documented starting command is: az apim show --name <apim-name> --resource-group <rg> --query "gatewayUrl" -o tsv, followed by the supplied curl POST request using the gateway URL and subscription key.