How to censor MCP servers with Azure APIM
17 Aug 2026
To reduce your “lethal trifecta” LLM attack surface, your company should probably prevent employees from using any MCP servers that aren’t censored via an API gateway.
Microsoft’s Sam Cogan just wrote up an example tutorial with Azure API Manager (“APIM”) on the Azure Blog earlier this summer.
I whipped up a quick Terraform demo to show it in action. Does what it says on the tin; thanks Microsoft..
See “Azure APIM MCP Gateway demo” source code on my GitHub.
Update 11/2/2026: Blegh, Microsoft just moved this out of normal Azure APIM and into a new preview service called AI Gateway, but at least as of today, the new service refuses to allow unauthenticated access into the MCP servers behind it.
The Microsoft Learn MCP server natively allows for anonymous, unauthenticated access. I’m not sure I’d even want an LLM harness authenticating into some sort of Entra principal just to use an MCP server that doesn’t require any authentication (seems like an unnecessary opportunity to leak a JWT into stuff because the harness got “creative”). And yet I do potentially want tool censorship, and I do potentially want all kinds of observability, rate-limiting, etc. about the calling of MCP servers.
Very frustrating! Microsoft should add a way to say that a given MCP server doesn’t require authentication at all, the way standard APIM allowed.
