A legacy monolith runs behind an internal load balancer on Azure VMs. You must incrementally migrate endpoints to microservices with zero downtime and preserve a single public API endpoint. The plan is to move one route at a time to new services while keeping the rest on the monolith. What should you implement?

Azure API Management (APIM) is the correct choice because it acts as a unified facade for multiple backend services, including legacy monoliths and new microservices. Its policy engine allows for sophisticated routing rules, such as path-based routing and URL rewriting, which are crucial for incrementally migrating specific API endpoints. This enables a "strangler fig" pattern, where new microservices gradually replace parts of the monolith without downtime, preserving a single public API endpoint. Fully rebuilding and a single DNS cutover is too risky and doesn't meet the "zero downtime" or "incremental migration" requirements. Exposing microservices directly via Front Door and removing the monolith doesn't allow for incremental, route-by-route migration while maintaining a single endpoint. Azure Traffic Manager operates at the DNS level and is not suitable for granular, path-based API routing; it's better for global traffic distribution. Replacing modules with Logic Apps and maintaining two public endpoints violates the "single public API endpoint" requirement.