Which Microsoft Graph permission type should App1 use for a user's calendar?
You have a Microsoft 365 subscription. You plan to deploy an app named App1 that will have the following configurations: • Will be registered in Microsoft Entra • Will access the signed-in user's Microsoft Outlook calendar by using the Microsoft Graph API You need to ensure that App1 can access Microsoft Graph. What should you use?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can distinguish delegated access (app acts on behalf of a signed-in user) from app-only access (app acts as itself) — the trap is seeing "registered in Microsoft Entra" and jumping to application permissions.
App1 is registered in Microsoft Entra and must read the signed-in user's Outlook calendar through Microsoft Graph, so it needs delegated permissions rather than app-only access. This page confirms that the SC-300 correct answer is delegated permissions (B) and explains why application permissions and RBAC roles do not fit.
Choosing application permissions (A) because the scenario mentions an Entra app registration; application permissions run without a signed-in user and would not model "the signed-in user's calendar" access.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
App1 calls Microsoft Graph to reach the signed-in user's Outlook calendar, which is the textbook definition of delegated access: the app borrows the user's identity and can only reach data that user can already see. Delegated permissions (B) are declared on the app registration, consented to by the user or an admin, and presented in the OAuth 2.0 authorization-code flow so Graph authorizes the call against the user's mailbox. As one commenter put it, "signed-in user's Microsoft Outlook calendar - is delegated permissions". Microsoft's own guidance separates Graph access into exactly these two models, and this scenario falls unmistakably into the delegated one.Why the Other Options Are Wrong
Application permissions (A) describe app-only access, where the app authenticates with its own identity (client credentials) and no user is present — the concept of "the signed-in user's calendar" disappears entirely, so a Graph call would be scoped to a mailbox the admin assigned, not to the interactive user. RBAC roles are the weaker distractors: a custom RBAC role (C) and a built-in RBAC role (D) govern administrative control-plane actions in Entra ID, such as managing users or groups, and cannot grant a token the Microsoft Graph calendar scopes App1 needs. Commenter mkendell argued for application permissions, but that reasoning conflates the app's ability to register with Entra and the API's data access model.Community Comment Notes
The consensus is effectively unanimous: penatuna explains that Microsoft Graph supports delegated and app-only access, and that because "the app will act behalf of the signed in user, so it's clearly delegated access", while Ziod and klayytech reduce it to the same shorthand. dzdz adds the operational nuance that delegated permissions require user consent, which is why App1 must be granted the appropriate Graph scope at consent time. The lone dissent from mkendell (application permissions) treats the app registration as the deciding factor, an over-reading that the question's phrase "signed-in user's" rules out.Official Reference
Exam Strategy
Highlight the phrase "signed-in user" (or "on behalf of") first — that single cue almost always maps to delegated permissions, while "without a signed-in user", "background service" or "daemon" maps to application permissions. If the option list offers RBAC roles as alternatives, remember RBAC governs Entra administrative actions, not Microsoft Graph data scopes.
Frequently Asked Questions
Why can't App1 just use application permissions for the user's calendar?
Application permissions are app-only: no signed-in user exists, so Graph would target a mailbox the admin scopes rather than the interactive user's own calendar.
Do custom or built-in RBAC roles in Entra ID grant Microsoft Graph calendar access?
No. Entra RBAC roles control administrative actions such as user or group management; Graph calendar access comes from OAuth scopes like Calendars.Read granted as delegated permissions.
What else does App1 need besides delegated permissions?
A consent grant (user or admin) for the Graph scope, then an authorization-code token request so the call runs in the context of the signed-in user.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →