--- title: "API Management SDK: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-mgmt-apimanagement-py/ description: "Pins Microsoft's API Management Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client." --- # API Management SDK: review, setup & limitations · Undominated.ai > Pins Microsoft's API Management Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client. [← Explore all skills](/skills/) API MANAGEMENT / Microsoft # API Management SDK Pins Microsoft's API Management Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Azure API Management SDK for Python. Use for managing APIM services, APIs, products, subscriptions, and policies. Triggers: "azure-mgmt-apimanagement", "ApiManagementClient", "APIM", "API gateway", "API Management". ” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The file says to prefer DefaultAzureCredential for the management client and to avoid connection strings, account keys, and API keys. - It says local development can use that credential as-is, while production must constrain the chain with AZURE_TOKEN_CREDENTIALS, and it requires context-manager cleanup. ### A good fit for - Calling the API Management client with DefaultAzureCredential rather than a connection string or account key - Apply an API-level XML policy that combines inbound rate limiting and header changes with forwarding to the backend. ### Weigh up before choosing - The resource was not executed. - `/plugin install azure-sdk-python@skills` installs the azure-sdk-python plugin group named in that plugin README, not this file alone. - The same plugin README also shows `npx skills add microsoft/skills --skill azure-sdk-python`, which adds that plugin pack rather than this one file. - The repository README's `/plugin install azure@skills` installs a different plugin. - Create and update samples have no dry-run and no confirmation step. This file does not show a delete. - The ban on API keys is about the management client's credential. A subscription sample still prints primary_key, and a named-value sample stores a secret value. - references/capabilities.md and references/non-hero-scenarios.md were not opened. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md - README.md - .github/plugins/azure-sdk-python/README.md - LICENSE ### Our findings - The file prefers DefaultAzureCredential and says it works locally as-is and in Azure without a code change. - It says to avoid connection strings, account keys, and API keys because they bypass Entra audit and rotation. - Production use must set AZURE_TOKEN_CREDENTIALS to prod or a named credential so the credential chain is constrained. - Clients and async credentials must be context managers so transports and token caches are released. - The shown constructor is DefaultAzureCredential() with no extra flag, which matches the local as-is rule. ### Not established by this review - The resource was not executed. - No API Management resource was created and no subscription key was read. - The referenced capabilities and non-hero scenario files were not opened. - The azure-sdk-python plugin was not installed. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) DOCUMENTED COMMAND /plugin install azure-sdk-python@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The azure-sdk-python plugin README shows `/plugin install azure-sdk-python@skills`. That installs the plugin group, not this one file. - The same README shows `npx skills add microsoft/skills --skill azure-sdk-python`, which adds that plugin pack from the repository. - The repository README shows `/plugin marketplace add microsoft/skills` and `/plugin install azure@skills` for a different plugin. ### Before you start - The skill's installation block names the packages azure-mgmt-apimanagement and azure-identity - AZURE_SUBSCRIPTION_ID, which the skill marks required for every auth method - AZURE_TOKEN_CREDENTIALS set to prod or a named credential when DefaultAzureCredential is used in production ### Compatibility GitHub Copilot · GitHub Copilot CLI ### Implementation python ### Local skill text; Azure calls happen only if an operator runs the samples - Read the skill text - Authenticate with DefaultAzureCredential only if the operator runs a sample - Create API Management objects only if the operator runs those samples ### Cost model MIT; no Azure or pip command was run 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-mgmt-apimanagement-py SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md Supports: DefaultAzureCredential, rejection of key-based client auth, and context-manager cleanup - [azure-sdk-python plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md Supports: /plugin install azure-sdk-python@skills for the plugin group - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: Copilot CLI plugin install for a different azure plugin, and the MIT statement - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License - [Pinned source sections reviewed in continuation W26 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md Supports: upstreamDescription, bestFor, review.reviewedAt, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### API Center management SDK ↗ Pins Microsoft's API Center Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client.](/skills/microsoft-azure-mgmt-apicenter-py/)[### Monitor OpenTelemetry exporter ↗ Pins Microsoft's Application Insights exporter skill, which uses Entra credentials for ingestion and requires an explicit telemetry shutdown.](/skills/microsoft-azure-monitor-opentelemetry-exporter-py/)[### Azure Web PubSub Service Python ↗ Pins the Web PubSub service Python skill, which prefers DefaultAzureCredential and says to limit client tokens with roles.](/skills/microsoft-azure-messaging-webpubsubservice-py/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)