What do "Protected Web API" refer in Microsoft Graph SSO Authentication Flow
We are building a web-based, JavaScript Outlook Add-In which is required to call Microsoft Graph APIs to access the Outlook's user's emails and attachments.
The authentication process is being implemented using Single Sign-On (SSO) as outlined in the Microsoft documentation below:
Authorize to Microsoft Graph with SSO - Office Add-ins | Microsoft Learn
For the server-side code of the Office Add-In, I am referring to the documentation on:
Acquiring tokens for a web app that calls a web API on behalf of a user, and I need some clarification regarding the phrase "calls a protected web API."
What exactly does "protected web API" mean in this context?