Can I override default routes for the vnet injected APIM instance towards the Hub firewall

Hello @Rajesh Swarnkar

Thank you for reaching out to Microsoft Q & A!

Yes, this is a supported and commonly used Hub-and-Spoke architecture pattern. A VNet-injected Azure API Management (APIM) instance can use User Defined Routes (UDRs) to override the default route and direct outbound traffic through a central Azure Firewall or Network Virtual Appliance (NVA).

However, you must ensure that APIM management traffic and required platform dependencies remain reachable through appropriate firewall rules, service tags, service endpoints, or route exceptions. Blocking or incorrectly routing required APIM dependencies can result in deployment, update, management, or runtime issues.

References:

• APIM virtual network reference: https://learn.microsoft.com/azure/api-management/virtual-network-concepts
• APIM network resource requirements: https://learn.microsoft.com/azure/api-management/virtual-network-reference
• Azure User Defined Routes (UDRs): https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview

These documents describe the supported use of custom routing and the network dependencies that must remain accessible when APIM is deployed in a virtual network.

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.