Delegated permissions
In Microsoft Entra, delegated permissions authorize an application to access a resource on behalf of a user, within both the application's granted permissions and the user's access rights.
The app acts for a signed-in user
The resource checks both the app’s delegated permission and the user’s access to the requested operation. Microsoft also calls these permissions scopes.
The app does not inherit everything the user can do; the grant limits it. Equally, a broad grant does not give the user access they did not already have.
What Files.Read.All means here
Microsoft Graph’s delegated Files.Read.All lets an app read files the signed-in user can access. It does not let the app read another employee’s private files just because the name contains All.
Graph also has an application permission with the same name. Always keep the permission type with the name when reviewing access, because the two work differently.
Who can approve it?
Consent may come from a user or an administrator, depending on the permission and tenant policy. An administrator can grant delegated consent across an organization. It still uses a user context; administrative approval does not turn it into app-only access.
The grant tells you what the app may do. Resource activity tells you whether it used that access.