Application permissions
In Microsoft Entra, application permissions authorize an application to access a resource as its own identity without a signed-in user.
Access without a signed-in user
Application permissions suit background services such as a backup process. In Microsoft’s model, they are app roles granted to an application. The app does not need an employee to be signed in when it calls the resource.
Read the permission type as well as the name
Microsoft Graph’s application Files.Read.All permission allows an app to read files across all site collections without a signed-in user. A proposed backup service requesting it needs a clear reason for that reach. Check whether a narrower design would do the job.
The delegated permission with the same name covers files the signed-in user can access. The names match, but the access models do not.
Approval and use are different questions
Microsoft Graph application permissions require administrator consent. For custom APIs, Microsoft’s broader model also lets an API service principal owner consent to application permissions that API exposes. Check who can approve access for the resource you are reviewing.
A grant shows what the app is allowed to do. Activity records show whether it read a file or performed another operation.
If app-only access is involved in an incident, include the application identity and its grants in containment. Resetting an employee’s password does not resolve access that never depended on that employee’s sign-in.