An umber-dye vat overnight worker lists every shop user at 02:00 with no human signed in. Which Microsoft Graph approach fits?
Select an answer to reveal the explanation.
Short Explanation
No human on the night shift means /me is a dead end. App-only (application) permissions plus admin consent let the daemon call Graph as itself—Managed Identity or a client credential can supply the token when the host is Azure.
Full Explanation
An overnight umber-dye vat worker with no interactive session is a daemon scenario. Microsoft Graph must be called with application (app-only) permissions that an administrator has consented to, using a client credential or managed identity to obtain a token as the app itself. Endpoints such as listing users are then authorized without GET /me or any operator's refresh token. That matches municipal night-shift automation where the plant floor is empty but directory sync must still run.
Calling GET /me against a browser session left open in the plant office fails on security and reliability: /me is delegated and tied to whoever is signed in, shared kiosk sessions are a credential hazard, and the session will expire. Relying only on delegated User.Read and hoping an operator remains logged in overnight fails for the same reason—delegated tokens require an active user context and User.Read alone does not authorize a full shop-user directory listing under an app identity. Publishing the user directory as a public Blob container skips Graph's authorization model entirely and exposes personal data without Entra controls, audit, or consent—unacceptable for shop identity data.
Exam caveat: application permissions are powerful; prefer the narrowest Directory/User application roles the job needs and document admin consent as a change-control item. Operational check: run the 02:00 job under the worker's managed identity or app registration with no user signed in, confirm token audience is Graph with roles (not only scp), and verify a forced sign-out of every plant PC does not stop the listing.