Default gateway association with APIM workspaces

Unable to associate the default APIM gateway with APIM workspace in v2 tier premium located in west europe

0 comments No comments
Sign in to comment

2 answers

  1. Siddhesh Desai 7,480 Reputation points • Microsoft External Staff • Moderator

    Hi

    Thank you for reaching out to Microsoft Q&A.

    Based on the provided documentation, here are the most important constraints that commonly block this:

    1. “Default managed gateway” vs “workspace gateway”

    In API Management Workspaces, you can route workspace traffic through:

    Default managed gateway (available in v2 tiers), or

    A dedicated workspace gateway (a separate gateway resource)

    The key point from the docs is:

    You can associate a workspace with the default managed gateway only in the v2 service tiers and through the Workspace REST API (workspace create/update).

    If you’re expecting to do this in the portal UI for a Premium workspace, note that the “default managed gateway association” workflow is explicitly documented as REST API only.

    1. Workspaces Gateway region must match APIM primary region

    For any gateway association using workspace gateways, the docs state:

    Workspace Gateway region must match the primary region of the API Management service that hosts the workspace.

    Multi-region support is not available with workspace gateways.

    So if APIM’s primary region isn’t actually West Europe (even if you’re working in West Europe), association can fail due to this mismatch.

    1. If you’re using a workspace gateway resource, network config is fixed after creation

    If your approach is actually creating/using a workspace gateway (not default managed gateway), then:

    VNET/network settings cannot be changed once the gateway is created.

    Any desired changes require creating a new gateway and deleting the previous one.

    1. Workspace gateway deployment is long-running

    If the issue you’re seeing is more about “it won’t complete” than “it fails immediately”:

    Workspace gateway creation can take 3+ hours (long-running operation).

    What to try (likely path for “default gateway association”)

    If your goal is specifically to use the default managed gateway with a workspace:

    Make sure you’re on an APIM v2 tier (Premium v2 qualifies).

    Use the Workspace - Create or Update REST API and set serveOn to workspaceAndDefault (this is the documented flag for routing through the default managed gateway).

    Confirm the API Management instance primary region matches where the workspace gateway expectations align.

    If instead you’re trying to associate a workspace gateway resource, then you’ll want to follow the portal “Create a workspace and associate a workspace gateway” path and ensure region/network constraints are satisfied.

    0 comments No comments
    Sign in to comment

  2. AI answer

    In the Premium v2 tier in West Europe, a workspace can be associated with the default managed gateway, but this is currently supported only via the API Management REST API, not through the Azure portal.

    Key points and checks:

    1. Tier and region support
      • Workspaces are supported in Premium and Premium v2 tiers.
      • West Europe supports Basic v2, Standard v2, and workspace gateways for Premium, but the default managed gateway is part of every API Management instance in all tiers.
      • Workspace gateways (separate gateway resources) for Premium are supported in West Europe.
    2. How to associate a workspace with the default managed gateway
      • Association with the default managed gateway is currently supported only in v2 tiers and only via the REST API.
      • Use the Workspace - Create or Update REST API and set the serveOn property to "workspaceAndDefault" when creating or updating the workspace:
       PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/workspaces/{workspaceId}?api-version=2024-05-01
 Authorization: Bearer {token}
 Content-Type: application/json
 
 {
 "properties": {
 "displayName": "my workspace",
 "description": "Workspace using default managed gateway",
 "serveOn": "workspaceAndDefault"
 }
 }
      • This configuration routes workspace API traffic through the service’s default hostname (for example, <service-name>.azure-api.net).
    3. Common reasons association appears to fail
      • Trying to configure the default managed gateway association from the Azure portal instead of via REST API (not supported yet).
      • Using a tier or region that does not support v2 features; ensure the API Management instance is actually Premium v2 in West Europe.
      • Not setting serveOn correctly in the REST payload.
    4. Alternatives if isolation is required
      • If stronger isolation or independent scaling/hostname/network configuration is needed, create a workspace gateway (Premium workspace gateway) in a supported region (West Europe is supported) and associate the workspace with that gateway instead of, or in addition to, the default managed gateway.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.
Sign in to answer

Your answer