360 Secure SkillHub
360 安全技能中心

azure-aigateway

该技能提供将 Azure API Management 配置为 AI 网关的操作指引，涵盖添加 Azure OpenAI 与 AI Foundry 后端、语义缓存、令牌限流、内容安全、MCP 限流等策略配置，并用 Azure CLI 与 curl 获取网关信息、测试端点、排查常见问题，另附内容安全与 API 管理 SDK 的精简参考。

microsoft
热度 0.00
最近更新 2026-10-18 15:54:30
分类：开发依赖：代码执行 / 第三方 API / 读写文件应用场景：API 集成 / DevOps / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add microsoft/azure-skills/azure-aigateway
Metadata
name
azure-aigateway
description
Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.
license
MIT
metadata
{"author":"Microsoft","version":"3.2.1"}
compatibility
Requires Azure CLI (az) for configuration and testing

Azure AI Gateway

Configure Azure API Management (APIM) as an AI Gateway for governing AI models, MCP tools, and agents.

To deploy APIM, use the azure-prepare skill. See APIM deployment guide.

When to Use This Skill

Category Triggers
Model Governance "semantic caching", "token limits", "load balance AI", "track token usage"
Tool Governance "rate limit MCP", "protect my tools", "configure my tool", "convert API to MCP"
Agent Governance "content safety", "jailbreak detection", "filter harmful content"
Configuration "add Azure OpenAI backend", "configure my model", "add AI Foundry model"
Testing "test AI gateway", "call OpenAI through gateway"

Quick Reference

Policy Purpose Details
azure-openai-token-limit Cost control Model Policies
azure-openai-semantic-cache-lookup/store 60-80% cost savings Model Policies
azure-openai-emit-token-metric Observability Model Policies
llm-content-safety Safety & compliance Agent Policies
rate-limit-by-key MCP/tool protection Tool Policies

Get Gateway Details

# Get gateway URL
az apim show --name <apim-name> --resource-group <rg> --query "gatewayUrl" -o tsv

# List backends (AI models)
az apim backend list --service-name <apim-name> --resource-group <rg> \
  --query "[].{id:name, url:url}" -o table

# Get subscription key
az apim subscription keys list \
  --service-name <apim-name> --resource-group <rg> --subscription-id <sub-id>

Test AI Endpoint

GATEWAY_URL=$(az apim show --name <apim-name> --resource-group <rg> --query "gatewayUrl" -o tsv)

curl -X POST "${GATEWAY_URL}/openai/deployments/<deployment>/chat/completions?api-version=2024-02-01" \
  -H "Content-Type: application/json" \
  -H "Ocp-Apim-Subscription-Key: <key>" \
  -d '{"messages": [{"role": "user", "content": "Hello"}], "max_tokens": 100}'

Common Tasks

Add AI Backend

See references/patterns.md for full steps.

# Discover AI resources
az cognitiveservices account list --query "[?kind=='OpenAI']" -o table

# Create backend
az apim backend create --service-name <apim> --resource-group <rg> \
  --backend-id openai-backend --protocol http --url "https://<aoai>.openai.azure.com/openai"

# Grant access (managed identity)
az role assignment create --assignee <apim-principal-id> \
  --role "Cognitive Services User" --scope <aoai-resource-id>

Apply AI Governance Policy

Recommended policy order in <inbound>:

  1. Authentication - Managed identity to backend
  2. Semantic Cache Lookup - Check cache before calling AI
  3. Token Limits - Cost control
  4. Content Safety - Filter harmful content
  5. Backend Selection - Load balancing
  6. Metrics - Token usage tracking

See references/policies.md for complete example.

Troubleshooting

Issue Solution
Token limit 429 Increase tokens-per-minute or add load balancing
No cache hits Lower score-threshold to 0.7
Content false positives Increase category thresholds (5-6)
Backend auth 401 Grant APIM "Cognitive Services User" role

See references/troubleshooting.md for details.

References

SDK Quick References