Question

Your company has a backend daemon service that must call a custom internal API (registered in Entra ID) without any signed-in user. The API defines two app roles: 'Orders.Read' and 'Orders.ReadWrite'. The daemon should only be able to read orders. You have already registered the daemon as its own application with a client secret. Which action grants the daemon exactly the read access it needs?

Accepted Answer

Add the 'Orders.Read' app role as an application permission under the API in the daemon's API permissions, then grant admin consent

Answer

Add the 'Orders.Read' scope as a delegated permission under the API in the daemon's API permissions, then grant admin consent

Answer

Assign the daemon's service principal to the 'Orders.Read' app role from the API's enterprise application under Users and groups

Answer

Grant the daemon the 'Orders.ReadWrite' application permission and rely on the API to reject write attempts