> For the complete documentation index, see [llms.txt](https://docs.jianny.net/work/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.jianny.net/work/azure/app-registration-auths.md).

# App Registration Auths

<figure><img src="/files/QE8Ay8Fz0rtvHpjljVHr" alt=""><figcaption></figcaption></figure>

| Item               | Delegated Permissions                                                                                 | Application Permissions                                                                       |
| ------------------ | ----------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| App type scenarios | Web / Mobile / Single-Page App (SPA)                                                                  | Web / Daemon                                                                                  |
| Access Context     | [Get access on-behalf of a user](https://learn.microsoft.com/en-us/graph/auth-v2-user)                | [Get access as a service](https://learn.microsoft.com/en-us/graph/auth-v2-service)            |
| Who can consent    | <ul><li>Users can consent for their data</li><li>Admin can consent for all users</li></ul>            | Only admin can consent                                                                        |
| Other names        | <ul><li>Scopes</li><li>OAuth2 permissions</li></ul>                                                   | <ul><li>App roles</li><li>App-only permissions</li><li>Direct access permissions</li></ul>    |
| Result of consent  | [oAuth2PermissionGrants](https://learn.microsoft.com/en-us/graph/api/resources/oauth2permissiongrant) | [appRoleAssignments](https://learn.microsoft.com/en-us/graph/api/resources/approleassignment) |

{% hint style="info" %}
Authentication flow support in Microsoft Authentication Library (MSAL)

<https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows>

![](/files/pA3RudjZ0uOwdDimkqVP)

Username/password (ROPC)
{% endhint %}

{% hint style="info" %}

### Graph Explorer

One of the most commonly used Azure APIs is the Graph.

We can use ["Graph Explorer"](https://developer.microsoft.com/en-us/graph/graph-explorer) to sample queries
{% endhint %}

{% hint style="info" %}

### Scope

Defines the set of permissions being requested by the application. Scopes can be either static (using [`.default`](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope)) or dynamic. This set can include the OpenID Connect scopes (`openid`, `profile`, `email`). If you need application permissions, you must use `.default` to request the statically configured list of permissions.
{% endhint %}

{% hint style="info" %}

### Lab Example for different programming languages

<https://learn.microsoft.com/en-us/graph/tutorials>

<img src="/files/mNLAv2vHyzcJNBqNcyWE" alt="" data-size="original">
{% endhint %}

{% hint style="danger" %}
To eliminate the need for App (or Client) secret, this option must be able so we can use the "UsernamePasswordCredential" auth method

![](/files/t40s6dKbF0nZ1SVctgg5)
{% endhint %}

### Code Snippets that show "Delegated Permission" property

<figure><img src="/files/9w7mVc1Go9MDtOCRVatK" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/a4tUK6VLyBRmOydXc1P2" alt=""><figcaption></figcaption></figure>

Grant Types

<https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc>