A tarn-depth logger already obtained user consent for User.Read. A new OneDrive export feature needs Files.Read. How should the app obtain the additional Graph permission?
Select an answer to reveal the explanation.
Short Explanation
Consent is not a one-shot forever stamp for every Graph scope. When a later feature needs Files.Read, ask for that scope then—incremental consent—rather than inventing a new tenant or stuffing scopes into Key Vault.
Full Explanation
Incremental (dynamic) consent lets an app request additional delegated scopes when a feature needs them, after earlier scopes such as User.Read were already granted. The new scope is requested at the point of use rather than forcing a full re-architecture. Key Vault does not store OAuth scopes, and switching solely to application permissions changes the auth model and still requires admin consent for app-only access.