SC-300 Certification Practice Question #197

Question

You have a Microsoft 365 subscription.

You plan to deploy an app named App1 that will have the following configurations:

•	Will be registered in Microsoft Entra
•	Will run as a service without user interaction
•	Will collect audit logs associated with user sign-ins
•	Will access resources by using the Microsoft Graph API

You need to ensure that App1 can access Microsoft Graph.

What should you use?

Accepted Answer

App1 runs as a service with no user interaction and calls Microsoft Graph as itself, which is exactly the app-only (daemon) access scenario. MS Learn states application permissions work without a signed-in user, whereas delegated permissions act on behalf of a signed-in user — impossible for a non-interactive daemon. RBAC roles (built-in or custom) govern directory/management-plane authorization, not the Graph API consent an app needs to call as a service. Suggested Answer, the Most Voted choice, the 3-👍 comment, and MS Learn all agree; confidence is held at 93 (not higher) because the Most Voted total is modest (4 votes), though the documentation is unambiguous.

More SC-300 practice questions