title: Product level authentication (AAD) for Azure API Management
body: <p>We are managing more 400 APIs in Azure API Management. We are also having an approval flow for approving the API subscription request, where a permission would be assigned to the API client app registration for authentication.</p>
  <p><strong>Problem</strong></p>
  <p>Since we have lots of APIs we are having as many API client app registrations and app registrations for each users subscribing the application. Also these API app registrations are available in three environments (DEV, QA and PROD). It became very difficult to manage the App Registrations. Also all these API client app registration have distinguished roles.</p>
  <p>We would like to reduce the number of app registrations and thinking to do a product level app registrations. Also instead of app registrations for each users, we want to have single app registration for each product subscription from a team .</p>
  <p>Here we are not sure about how to manage roles for each APIs as each API has different Roles. And an API based app registration will have all roles, how do we assign these roles to each Users.</p>
  <p>eg: We have a product <strong>ProductA</strong> , it has 10 APIs under it. We create one APP registration <strong>ApiAppA</strong> for this product and this app registration can be used for AAD authentication. It has two App Roles <strong>Api1.Read</strong> and <strong>Api2.Write</strong> for two APIs say <strong>Api1</strong> and <strong>Api2</strong>. Now as a subscriber, we will have another app registration say <strong>ClientAppB</strong>. We are planning use the client credential flow from <strong>ClientAppB</strong> to connect to the <strong>ProductA</strong> via <strong>ApiAppA</strong> app registration. So when a User say <strong>John</strong> want to subscribe to an API under ProductA. He only wants <strong>Api1.Read</strong> for <strong>ApiAppA</strong>. Also another user <strong>Tom</strong> wants to subscribe to another API under Product A, where he need access to <strong>Api2.Write</strong> role. How do we assign it? We are using client credential flow.</p>