Click on the following steps in the correct order to protect an API in Azure API Management with Microsoft Entra ID:
Enable OAuth 2.0 user authorization and add the validate-jwt policy to validate the OAuth token for API calls.
Register the web App (website containing summarized results) in Microsoft Entra ID so that it can call the backend API.
Allow permissions between the website app to call the backend API app. Add the configurations in Microsoft Entra ID.
Register the backend API application in Microsoft Entra ID.