How do you stop malicious requests in Azure APIM from repeatedly hitting your rate or quota limits?
You can rate limit or throttle based on the IP: https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#ip-address-throttling
Also, Azure DDoS Protection Basic doesn't cover much. It won't know what is normal or not for your application without paying the ~$3,000 per month for the Standard plan.