A ferry kiosk must read only the signed-in clerk’s profile, not every user in the tenant. Which permission type should be added on the app registration?
Select an answer to reveal the explanation.
Short Explanation
The kiosk should see the clerk who’s standing there—not the whole passenger manifest. That is a delegated scope like User.Read, not an application permission that acts as the app with nobody at the counter.
Full Explanation
Delegated permissions (scopes) authorize the application to act on behalf of the signed-in user and are appropriate when only that user’s profile is required. Application permissions run without a user and are overly broad for a clerk-facing kiosk that should not read every directory user. High-privilege directory or SharePoint application/delegated permissions do not correctly express least-privilege profile read for the signed-in clerk.