A siskin-feed station web app can call Microsoft Graph with the Graph SDK client or with an HTTP GET to https://graph.microsoft.com/v1.0/.... Which statement is accurate for the developer?
Select an answer to reveal the explanation.
Short Explanation
Think of Graph like a locked municipal records counter: whether you use the official SDK clipboard or dial the same REST URL yourself, you still need a badge. The SDK is convenience, not a free pass.
Full Explanation
Microsoft Graph is an HTTPS API fronted by the Microsoft identity platform. The Graph SDK wraps that same surface with typed clients and helpers; a raw GET to https://graph.microsoft.com/v1.0/... hits the identical endpoint family. For the siskin-feed station web app, either approach is valid. What both require is an access token (or a credential/token factory that can obtain one) scoped for Graph. The SDK does not bypass Entra ID—it still acquires tokens through MSAL or Azure.Identity and attaches them as Bearer credentials.
Claiming only the SDK may reach Graph fails on a basic network fact: graph.microsoft.com accepts properly authenticated REST. Teams routinely call Graph with HttpClient, PowerShell, or curl in municipal automation. Treating Graph as a public catalog that needs no token fails because directory and Microsoft 365 data are protected resources; unauthenticated calls receive 401 Unauthorized. Asserting that the SDK replaces Entra ID fails because the SDK is a client library, not an identity provider—without a credential at startup (interactive user, client secret, certificate, or managed identity), token acquisition never starts.
Exam caveat: choosing SDK versus raw REST is an engineering preference (typing, retry helpers, pagination), not an authorization decision; scopes and consent still matter equally. Operational check: before shipping the feed-station feature, capture a failed call without Authorization, then the same call with a valid Graph token, and confirm the municipal app's App Registration exposes only the Graph permissions the page actually uses.