A daemon that syncs lock schedules needs application Mail.Send with no signed-in user. What must the security engineer understand when adding that permission on the app registration?
Select an answer to reveal the explanation.
Short Explanation
Daemons do not have a clerk to click Accept. Application Mail.Send rides the admin-consent / .default path—user consent prompts will not hand that permission to a background sync job.
Full Explanation
Application permissions allow an app to call an API as itself without a user and require administrator consent. Clients typically request them using the .default scope for that resource. User consent prompts do not grant application permissions, and delegated permissions assume a signed-in user unsuitable for an unattended daemon. Localhost redirect URIs do not bypass admin consent for application Mail.Send.