Example Reference Network Topologies for API Management in private mode.

Thanks for the write up, and very useful to see this in such concise detail. 

One question I do have, and I must admit it's confusing me a bit (which probably isn't hard to be honest). But much of the recent guidance from Microsoft regarding app gateway is to place it in the spokes and not in the hub. Effectively deploying a dedicated App Gateway 'per app', in the spoke. Now, this guidance seems odd to me as I've generally placed AppGWs in the hub, where they are supported by a net-sec team (that understands networking , net-sec, WAFs etc.. 

Does this contradict that guidance or is there something I'm missing?

Thanks

Andy