I need to configure an API in Azure API Management to deny all incoming requests by default, regardless of their content or authentication. My goal is to ensure that the base policy denies all requests. However, there are some specific APIs that should work correctly and allow valid requests.

Here’s the policy configuration I think might work:

                <claim name="roles" separator=" ">
                    <value>deny_all</value>
                </claim>

I have set the validate-jwt policy to check for a specific claim (roles) with a value that is never valid (deny_all). This is intended to deny all requests by default.

Could someone provide guidance or a better approach to achieve this?

Additionally, I want to ensure that specific APIs with correct key and value in the JWT should be allowed to function normally, while the base policy remains restrictive.

Any help or suggestions would be greatly appreciated.