An application registers in Azure AD to call Microsoft Graph. What type of permissions should it request for background service-to-service calls (no user context)?
- A Delegated permissions (user context)
- B Application permissions (app-only, with admin consent) (correct answer)
- C Personal access tokens
- D Azure AD B2C scope
Shortcut: Application permissions (app roles) are granted with admin consent and allow the app to act as itself without a signed-in user. Delegated permissions require a user context (access token on behalf of user).