This policy snippet prevents one from using the master key by accident.

apim-masterkey-prevention.policy.xml

<choose>
    <when condition="@(context.Subscription != null && context.Subscription.Id == "master")">
        <return-response>
            <set-status code="400" reason="Bad Request" />
            <set-header name="Content-Type" exists-action="override">
                <value>application/json; charset=UTF-8</value>
            </set-header>
            <set-body>{"message": "Access denied due to invalid subscription key."}</set-body>
        </return-response>
    </when>
</choose>

Hi there,
Does this Gist still work? I've deployed a new APIM instance today and copy/pasted this Gist to the global "App APIs" inbound policy but can still call API's with the service master subscription key.
I've confirmed by setting an outbound header that context.Subscription.Id is definitely "master", but I can't work out why the inbound policy isn't evaluated.
I would appreciate your thoughts.

Hi there,
Does this Gist still work? I've deployed a new APIM instance today and copy/pasted this Gist to the global "App APIs" inbound policy but can still call API's with the service master subscription key.
I've confirmed by setting an outbound header that context.Subscription.Id is definitely "master", but I can't work out why the inbound policy isn't evaluated.
I would appreciate your thoughts.

You know what - ignore that - found that my API's don't have <base /> included! Added that and success! Thanks for the Gist!