Challenge getting APIM Consumption Tier working with ACA

[gcrockenberg]

Restricting ACA (external) Ingress to APIM by IP ranges works on the Developer Tier or higher where APIM provides a specific IP address.

The same ACA restriction when using the APIM Consumption plan fails with an "RBAC: access denied" error in APIM. This is true even when following the instructions found at https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-ip-addresses#ip-addresses-of-consumption-tier-api-management-service

and adding all of the "ApiManagement.EastUS" IP address ranges in the ServiceTags_Public_20230710.json file.

The highlighted portion of the attached picture is the static IP provided by APIM on the Developer tier. All the other IP addresses were specified in the "ServiceTags" file from the instructions link. The Consumption Tier APIM was able to import the swagger definitions to define the API but testing the API in APIM consistently raises the "RBAC: access denied" error.