diff --git a/pkg/frontend/clustermanager_delete.go b/pkg/frontend/clustermanager_delete.go
index 354f7a8a4..b2148541c 100644
--- a/pkg/frontend/clustermanager_delete.go
+++ b/pkg/frontend/clustermanager_delete.go
@@ -19,6 +19,11 @@ func (f *frontend) deleteClusterManagerConfiguration(w http.ResponseWriter, r *h
 	ctx := r.Context()
 	log := ctx.Value(middleware.ContextKeyLog).(*logrus.Entry)
 
+	if DISABLEOCMAPI {
+		reply(log, w, nil, []byte("forbidden."), api.NewCloudError(http.StatusForbidden, api.CloudErrorCodeForbidden, "", "forbidden."))
+		return
+	}
+
 	err := f._deleteClusterManagerConfiguration(ctx, log, r)
 	switch {
 	case cosmosdb.IsErrorStatusCode(err, http.StatusNotFound):
diff --git a/pkg/frontend/clustermanager_get.go b/pkg/frontend/clustermanager_get.go
index 6144c0bc6..4356018ab 100644
--- a/pkg/frontend/clustermanager_get.go
+++ b/pkg/frontend/clustermanager_get.go
@@ -21,6 +21,11 @@ func (f *frontend) getClusterManagerConfiguration(w http.ResponseWriter, r *http
 	log := ctx.Value(middleware.ContextKeyLog).(*logrus.Entry)
 	vars := mux.Vars(r)
 
+	if DISABLEOCMAPI {
+		reply(log, w, nil, []byte("forbidden."), api.NewCloudError(http.StatusForbidden, api.CloudErrorCodeForbidden, "", "forbidden."))
+		return
+	}
+
 	b, err := f._getClusterManagerConfiguration(ctx, log, r, f.apis[vars["api-version"]].ClusterManagerConfigurationConverter())
 	reply(log, w, nil, b, err)
 }
diff --git a/pkg/frontend/clustermanager_putorpatch.go b/pkg/frontend/clustermanager_putorpatch.go
index aea0e8336..29089a1b4 100644
--- a/pkg/frontend/clustermanager_putorpatch.go
+++ b/pkg/frontend/clustermanager_putorpatch.go
@@ -22,9 +22,14 @@ func (f *frontend) putOrPatchClusterManagerConfiguration(w http.ResponseWriter,
 	ctx := r.Context()
 	log := ctx.Value(middleware.ContextKeyLog).(*logrus.Entry)
 	vars := mux.Vars(r)
-
 	var header http.Header
 	var b []byte
+
+	if DISABLEOCMAPI {
+		reply(log, w, nil, []byte("forbidden."), api.NewCloudError(http.StatusForbidden, api.CloudErrorCodeForbidden, "", "forbidden."))
+		return
+	}
+
 	err := cosmosdb.RetryOnPreconditionFailed(func() error {
 		var err error
 		b, err = f._putOrPatchClusterManagerConfiguration(ctx, log, r, &header, f.apis[vars["api-version"]].ClusterManagerConfigurationConverter())
diff --git a/pkg/frontend/frontend.go b/pkg/frontend/frontend.go
index dac3b95f0..fe7b9f4f3 100644
--- a/pkg/frontend/frontend.go
+++ b/pkg/frontend/frontend.go
@@ -32,6 +32,8 @@ import (
 	"github.com/Azure/ARO-RP/pkg/util/recover"
 )
 
+const DISABLEOCMAPI = true
+
 type statusCodeError int
 
 func (err statusCodeError) Error() string {