Guidance on React and API auth

Hi, I have a react client app that speaks to a backend GraphQL server and all is well.

I would however, like for the client to talk to Azure’s ARM API end point directly. I have managed to get this to work on a backend server using a service principal. However, if I try and do the same in the React app client, it throws errors.

Question - is connecting via the client the correct approach or should I be handling this at the backend and effectively having the client proxy Azure API requests via my backend rather than directly.

The latter seems inefficient; the former, less secure. Thanks for nudging me in the right direction.