Using WordPress? Every integration here is also available as a plugin. Browse the plugin store →

Knowledge base Web components Authentication and access

Microsoft Graph access: managed mode or proxy mode

Two ways a component can reach Microsoft 365. In managed mode we hold the Azure credentials and your IT does a one-time consent; in proxy mode you hold them and Graph traffic never leaves your perimeter.

Published 12 August 2026

  • microsoft graph
  • managed
  • proxy
  • azure
  • admin consent
  • authentication
  • enterprise

Every component reads a Microsoft 365 source, and that read has to be authorised somehow. There are exactly two modes, and an account is set to one of them.

Managed mode

WPIntegrate holds the Azure application registration. Your Microsoft 365 administrator grants admin consent once, for your tenant, and after that we acquire access tokens for your tenant as they are needed and call Graph on your behalf.

Choose this if you want the shortest path to a working component and you are comfortable with a vendor holding delegated access to the scopes the components need.

What your IT admin has to do: one consent, once. There is no application to register on your side, no client secret to rotate on your side, and no infrastructure to run.

Proxy mode

You stand up your own endpoint — commonly an API gateway in front of Graph — and give us its base URL and an API key. Components then call your endpoint instead of calling Graph directly.

Choose this if your organisation will not delegate Graph access to a third party, or if Microsoft 365 traffic is required to stay inside a network perimeter you control. This is the reason the mode exists, and it is the difference between “we cannot use this” and “we can” for a lot of enterprises.

What you take on: you own the endpoint, its availability, and the Azure application behind it. Whatever a component cannot read through your proxy, it cannot show.

The API key you give us is encrypted at rest, and it is stripped from the configuration before it is sent to the browser — it is a server-side field and never reaches your visitors’ pages.

Which one am I on?

The mode is a property of your account, visible in the dashboard. It is not something a page author sets, and it is not something the embed markup can change — the two lines of HTML on your page are identical either way.

What does not change between them

  • The embed snippet.
  • The configuration you build in the dashboard.
  • The licensing and domain checks, which happen before either mode is reached.
  • What the visitor sees.

The mode decides where the Graph call originates, and nothing above that line.

Read next

  • Web components · Getting started

    Quick start: putting a web component on a page

    What the two lines of an embed actually are, what the browser does with them, and what has to be true before a component renders.

  • Web components · Embedding

    Ways to place a component on the page

    The custom element is the normal form. A plain div with a data attribute is the fallback for editors and page builders that strip unknown tags.

  • Web components · Configuration

    How the embed key works, and why it is not a secret

    The embed key names one configured component instance. It travels in your page source, so it is public by design — the protections sit on the server, not on the key.

Back to the knowledge base