Contoso exposes several on-premises services through Azure Logic Apps with HTTP triggers. A partner organization (Fabrikam) uses a third-party OAuth 2.0 identity provider (no Azure AD tenant) and its developers need programmatic access to a subset of Contoso's logic apps. The solution must: (1) allow Fabrikam developers to use their existing OAuth 2.0 provider, (2) apply stricter rate limits for partner requests than for Contoso users, (3) require no changes to the existing logic apps, and (4) not use Azure AD guest accounts. Which service should you include in the design?

Azure API Management is the correct choice because it directly addresses all requirements. It can integrate with Fabrikam's existing OAuth 2.0 identity provider for authentication (1), allowing programmatic access. API Management policies enable granular control over request rates, allowing stricter limits for partner requests than for internal users (2). As a facade in front of the Logic Apps, it requires no changes to the existing Logic Apps themselves (3). Finally, since Fabrikam uses a third-party OAuth 2.0 provider and not Azure AD, Azure AD B2B or guest accounts are not applicable (4). Azure Front Door is a global load balancer and WAF, not an API gateway for authentication and rate limiting. Azure AD Application Proxy is for publishing internal web apps for external access, typically with Azure AD authentication, which doesn't fit the third-party OAuth 2.0 requirement.