Can you backup API Management Instance without including the product subscription keys

For the built-in APIM backup/restore operation, I would treat the backup as a full service-state backup, not as a selective export. The documented backup/restore path is meant for disaster recovery of the APIM instance, so subscriptions and keys are part of the service state.

If the concern is security, the safer pattern is usually:

1. Protect the backup storage account tightly: private access, encryption, limited RBAC, short-lived SAS if used, and lifecycle controls.

2. Use IaC/export for configuration promotion when you do not need users/subscriptions/keys copied.

3. For DR restore, immediately regenerate affected subscription keys after restore and notify downstream consumers through your normal key-rotation process.

So the practical answer is: not with the built-in full backup. Use config-as-code for a keyless config migration, or rotate keys after a full restore.

Useful docs:

https://learn.microsoft.com/azure/api-management/api-management-howto-disaster-recovery-backup-restore

https://learn.microsoft.com/azure/api-management/api-management-subscriptions