A nightly daemon written in C# runs without any signed-in user and must call the Dataverse Web API for the environment https://contoso.crm.dynamics.com. The app registration has a client secret, and an application user exists in the environment. When the daemon requests a token with MSAL using the client credentials flow, which scope should it request?

In the OAuth 2.0 client credentials flow there is no signed-in user, so the application cannot request delegated permissions. Microsoft Entra ID requires the scope to be the resource identifier followed by /.default, which tells the token service to issue an app-only token for that resource. For Dataverse, the resource identifier is the environment URL, so the daemon requests the environment URL with /.default appended, and the resulting access token carries that environment as its audience. Dataverse then maps the application ID in the token to the application user and applies that user's security roles. Requesting user_impersonation is the delegated pattern used by public or confidential clients acting on behalf of a signed-in person; with client credentials there is no user to impersonate, so that scope is invalid for this flow. A Microsoft Graph scope yields a token whose audience is Graph, which Dataverse rejects as issued for a different resource. The Web API endpoint path is not a scope at all; scopes name a resource and permission, not a REST route, and the api subdomain form is a service endpoint rather than the resource identifier used for tokens. Exam caveat: the token audience must match the environment that receives the call. Operational check: decode the token and confirm the aud claim equals the environment URL and that the roles or appid claims identify the daemon.