You register a new daemon application in Microsoft Entra ID that runs as a background service with no signed-in user. The application must read all users' profiles from Microsoft Graph by calling the API unattended using its own identity. When you configure Microsoft Graph permissions in the app registration, which permission type must you add and what additional step is required before the app can access the data?