Supply MSAL.NET with a Reusable Proxy Client

MSAL.NET can obtain its HTTP transport from IMsalHttpClientFactory. Wrap a client configured for the proxy:

sealed class TokenHttpFactory : IMsalHttpClientFactory
{
    private readonly HttpClient client;

    public TokenHttpFactory(HttpClient client)
    {
        this.client = client;
    }

    public HttpClient GetHttpClient() => client;
}

Create the handler and client once for the application lifetime, then attach the factory during the existing MSAL builder configuration:

var proxy = new WebProxy("http://proxy.example:8080");
var handler = new HttpClientHandler { Proxy = proxy, UseProxy = true };
var tokenHttp = new HttpClient(handler);

builder.WithHttpClientFactory(new TokenHttpFactory(tokenHttp));

The builder is the application's existing MSAL application builder; retain its authority, client registration and credential configuration. For an allowed publicly reachable HTTPS authority route with no proxy account, an HTTP address from the HTTP proxy list can fill the example WebProxy. Configure proxy credentials on the WebProxy when needed.

The factory must be thread-safe. Reuse the client instead of constructing one inside every GetHttpClient call. MSAL does not dispose the supplied client; its owner manages that lifetime.

This controls MSAL's HTTP requests. Interactive sign-in can open a browser whose networking is separate. A working browser login therefore does not prove that the token HTTP client has the same route.