Chapter 3 of 6
The platform owner confirms an existing APIM Basic v2, Standard v2, or Premium v2 instance with system-assigned managed identity. Do not infer network, zone, or multi-region support from the word "v2"; approve the actual tier and region capabilities for this route.
The Foundry owner confirms Marketplace eligibility, terms, selected model versions, and where each deployment is hosted. Claude models do not have to be hosted on Azure. Hosting location does not by itself imply single-region processing: confirm Global or Data Zone scope against the residency decision. Use the model card and deployment details, not a client alias, as the model authority.
The APIM operator needs time-bound Contributor on the exact APIM resource group and Reader on the Foundry resource for preflight. The role-assignment owner needs User Access Administrator on the Foundry resource. That owner grants APIM Cognitive Services User, scoped to the Foundry resource, for the documented keyless inference path. The Entra owner needs Application Administrator to configure the dedicated apps, enterprise-app assignments, and delegated consent.
Developers need Azure CLI for Code. Desktop needs third-party inference configuration and version 1.6889.0 or later for interactive SSO. The endpoint-management owner confirms the supported build and managed-setting locations on each device platform.
Use the gateway design principles from Session 06. Its Responses API, agent-specific role, and Content Safety policy are for a different backend. Do not apply them unchanged to this Messages API.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Record | gateway-inputs.json | The preflight scripts and gateway operator |
| Deployment | api-policy.xml | The API Management gateway runtime |
| Deployment | budget-fragment.xml | The API Management gateway runtime |
| Runtime | claude-code-settings.json | The endpoint-management owner and Claude Code |
| Runtime | get-entra-token.sh | Claude Code on Bash-capable developer devices |
| Runtime | get-entra-token.ps1 | Claude Code on PowerShell developer devices |
Copy the artifacts to a protected customer working directory outside source control. Replace every decision sentinel in those copies. Keep tenant IDs, resource names, endpoints, UPN overrides, tokens, and MDM exports out of this repository. Install Python 3 and Azure CLI on the operator workstation.