Configure a Proxy for Microsoft Graph SDK v5 and Azure Identity

Graph API calls and ClientSecretCredential token requests have separate transport entry points. With Microsoft.Graph 5 and Azure.Identity, configure both before constructing the client:

var proxy = new System.Net.WebProxy(
    "http://proxy.example.net:8080");

var tokenHandler = new System.Net.Http.HttpClientHandler
{
    Proxy = proxy,
    UseProxy = true
};

var credentialOptions = new Azure.Identity.ClientSecretCredentialOptions
{
    Transport = new Azure.Core.Pipeline.HttpClientTransport(tokenHandler)
};

var credential = new Azure.Identity.ClientSecretCredential(
    tenantId, clientId, clientSecret, credentialOptions);

var authProvider =
    new Microsoft.Kiota.Authentication.Azure.AzureIdentityAuthenticationProvider(
        credential, scopes: new[] { "https://graph.microsoft.com/.default" });

var graphHttp = Microsoft.Graph.GraphClientFactory.Create(proxy: proxy);
var graphClient = new Microsoft.Graph.GraphServiceClient(
    graphHttp, authProvider);

For an unauthenticated public HTTP route, the HTTP proxy list provides candidate addresses for the shared WebProxy. The application supplies tenantId, clientId and clientSecret through its existing credential handling. The .default scope uses the application permissions configured for that registration; a route cannot grant permissions.

Read the two transport lines as the important pair. HttpClientTransport(tokenHandler) carries the credential's token request. GraphClientFactory.Create(proxy: proxy) keeps the Graph SDK's HTTP middleware construction while configuring its API route.

If the intermediary requires authentication, assign the required account to the proxy object's Credentials. Retain owned transports for the component's lifetime and dispose them at shutdown.

Use this pattern with the stated SDK generation. HttpProvider and DelegateAuthenticationProvider examples belong to an earlier generation and cannot be mixed into this constructor chain.