I would like to deploy Azure OpenAI as a web app, and use APIM to enforce quota limits for users based on their UPNs. How should this be implemented?

Hi 凯旋 李,

Great question! Here’s how you can deploy Azure OpenAI as a web app and enforce user-based quota limits using Azure API Management (APIM):

Expose the Web App through APIM: Publish your Azure OpenAI web app endpoint as an API in Azure API Management.

User Identification via UPN: Require authentication (such as Azure AD) so each user’s UPN (User Principal Name) becomes available in headers or as a claim.

Apply Quota Policies: In your API Management policy, use the <quota> policy within the <inbound> section. You can key quotas by UPN for personalized limits, for example:

xml
<quota-by-key calls="1000" renewal-period="3600" counter-key="@(context.Principal.Identity.Name)" />

This limits each user (by UPN) to a set number of calls per period.

Token Quotas in Azure OpenAI: Azure OpenAI does not natively support per-user token quota settings, but you can enforce token limits at the API layer with custom policies or code (by tracking token usage per user and rejecting requests that exceed limits).

Automation and Monitoring: Use Azure Monitor and APIM analytics to track quota consumption and alert users.

In summary, leverage APIM for request-based quotas by UPN, and track token usage with custom code in your app or via API policies.

Best regards,

Jerald Felix

If I want to target specific users, how should I set it up? For example, I want A to use 1000 and B to use 2000

Hello 凯旋 李,
To set up different quota limits for specific users (for example, user A can use 1000 calls and user B can use 2000 calls), you should use Azure API Management (APIM) policies with a combination of conditional logic and the <quota> policy. Here’s a practical approach:

1. Expose the Azure OpenAI web app through APIM as an API.

Authenticate users—typically with Azure AD. This ensures you have the user's UPN available in the incoming request.

Apply user-specific quotas with policy logic. In the APIM policy for the API, you can add conditional logic in the <inbound> section to check the user's UPN and assign different quota limits. Here’s an example in policy XML:

xml
<inbound>
    <choose>
        <when condition="@(context.Principal.Identity.Name == "******@yourdomain.com")">
            <quota-by-key calls="1000" renewal-period="3600" counter-key="@(context.Principal.Identity.Name)" />
        </when>
        <when condition="@(context.Principal.Identity.Name == "******@yourdomain.com")">
            <quota-by-key calls="2000" renewal-period="3600" counter-key="@(context.Principal.Identity.Name)" />
        </when>
        <otherwise>
            <quota-by-key calls="500" renewal-period="3600" counter-key="@(context.Principal.Identity.Name)" />
        </otherwise>
    </choose>
</inbound>

Replace "******@yourdomain.com" and "******@yourdomain.com" with the actual UPNs.

Token quotas: Azure OpenAI does not natively support per-user token quotas, so if you need to track and enforce token-based limits (rather than just request counts), you’ll need to implement this logic yourself—either in your web app’s code or with a combination of APIM usage logging, Azure Monitor, and custom business rules.

Best Regards,

Jerald Felix

• Error in element 'choose' on line 5, column 6: 'IProxyRequestContext' does not contain a definition for 'Principal' and no extension method 'Principal' accepting a first argument of type 'IProxyRequestContext' could be found (are you missing a using directive or an assembly reference?)

Hello 凯旋 李 •,

The error you are seeing means that context.Principal is not available in that APIM context — most likely because authentication is not properly configured, or the policy is being applied before the user is authenticated.

1. context.Principal is not supported — use context.Request.Claims instead.
2. The JWT token must include the upn claim, which is only accessible after successful validation with <validate-jwt>.
3. Without validating the token, user identity info is not available in APIM.

• Enable Azure AD authentication using the <validate-jwt> policy in the APIM inbound section.
• Extract the UPN from the JWT token using: <set-variable name="userUpn" value="@(context.Request.Claims.GetValueOrDefault("upn"))" />
• Apply conditional quotas using the <choose> block and match userUpn against specific users: <when condition="@(context.Variables["userUpn"] == "******@domain.com")">