A municipal mackerel-auction night worker runs with no signed-in user and must call a protected city API. Which OAuth 2.0 flow should the developer use?
Select an answer to reveal the explanation.
Short Explanation
No human at the keyboard means no interactive sign-in. Client credentials is the daemon path—the app shows up as itself, not as a clerk.
Full Explanation
Daemon and service-to-service callers use the OAuth 2.0 client-credentials grant against the Microsoft identity platform. The token represents the application, not a user, so delegated scopes that require a signed-in subject do not apply. Authorization-code and device-code flows assume interactive user participation, which this night worker lacks.