A background daemon service has no signed-in user and must read all users' profiles from Microsoft Graph on a recurring schedule. The identity team registers the application and must decide which kind of Microsoft Graph permission to configure and how access is authorised. What is the correct approach?
- AConfigure application User.Read.All permission and grant tenant-wide admin consent for the registered application. Correct
- BConfigure delegated User.Read.All permission and have the daemon prompt each user to consent the first time their profile is read.
- CConfigure delegated User.Read.All permission and enable the admin consent workflow so an administrator approves the request to run the daemon.
- DConfigure application User.Read.All permission and let each user grant user consent the first time the daemon reads their data.
Why A is correct: Application permissions let the app act as itself without a user, and admin consent authorises that permission across the tenant, which is exactly how an unattended daemon reads all profiles from Microsoft Graph.
Why B is wrong: Delegated permissions act on behalf of a signed-in user and require an interactive sign-in, which a background daemon with no user cannot provide, so this approach cannot run unattended.
Why C is wrong: The admin consent workflow routes a user's request for delegated access to an approver, but delegated access still needs a signed-in user, so the daemon cannot operate without an interactive session.
Why D is wrong: Application permissions can never be authorised by user consent; they require admin consent, so relying on per-user consent leaves the daemon unauthorised for its app-only calls.