A security-conscious organization is developing a critical backend daemon service that requires unattended access to Microsoft Graph. This service needs to perform two distinct, high-privilege operations: 1. Retrieve the full profile details for all users across the entire Microsoft Entra tenant. 2. Send emails from a designated shared mailbox without user interaction. The organization's security policy strictly enforces the **principle of least privilege** and mandates that all necessary permissions for this daemon service must be granted through **admin consent**. Which configuration approach correctly defines the required permissions and ensures they are granted appropriately for this application?