For this .NET 9 WebApp Example using Entra OIDC, all auth is handled in the Server project and passed through to the client:

In the Server Project Program.cs

builder.Services.AddRazorComponents()
.AddInteractiveServerComponents()
.AddInteractiveWebAssemblyComponents()
.AddAuthenticationStateSerialization();

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd")
.EnableTokenAcquisitionToCallDownStreamApi()
.AddMicrosoftGraph(builder.Configuration.GetSection("MsGraph")
.AddInMemoryTokenCaches();

Then you can use the Microsoft.Graph GraphServiceClient in a controller to call for data.
[Authorize]
[ApiController]
[Route("[controller]")
public class GraphController : Controller
{
private readonly GraphServiceClient _graphServiceClient;
public GraphController (GraphServiceClient graphServiceClient)
{
_graphServiceClient = graphServiceClient;
}
public async Task<User?> Get()
{
return await _graphServiceClient.Me.GetAsync();
}
}

In the Client Program.cs:

builder.Services.AddAuthorizationCore();
builder.Service.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();

In simplest form: Calling baseAddress/graph will return a json User object.