We have several underused APIM instances across landing zones and want to consolidate them to reduce costs. Configuration could be managed with APIOps or workspaces, but we haven't decided yet.
Would you put central APIM in a dedicated landing zone, the Connectivity subscription, or a shared Services subscription? I'm especially concerned about permission scope and keeping costs clear.
A dedicated landing zone or subscription for APIM is a reasonable choice here. It keeps the cost boundary clear and gives you room to assign APIM permissions without mixing them with access to core networking resources.
That doesn't remove the need to review role assignments. The useful distinction is that a mistake at subscription scope would be contained to the APIM subscription rather than potentially affecting Connectivity too.
A shared platform services subscription can work too. APIM could sit alongside other shared services such as Application Gateway and Azure Container Registry, with costs managed together for chargeback.
The catch is governance. Decide what qualifies as a shared platform service and who owns it, otherwise a Services subscription can become a dumping ground.
I wouldn't choose Connectivity just because APIM handles traffic. Look at who needs access and what scope they need it at. A subscription-wide contributor assignment there could give someone more access to networking resources than intended.
If the team still prefers Connectivity, agree on the permission boundaries and review process first. That's a more useful discussion than arguing over the subscription name.
The Azure AI Landing Zones reference architecture and infrastructure templates are worth reviewing as a starting point. Compare their approach with your own ownership and access requirements rather than treating a template as a rule.
Answers are reviewed before publication.
almost-lateral:
If you go with workspaces, check their current limitations and gateway requirements before treating them as the answer to team separation.