Delegated vs Application Permissions

To access secured data, applications request access tokens using industry-standard protocols like OAuth 2.0 and OpenID Connect. Applications can request specific API permissions that define what resources they can access and what actions they can perform. These permissions are categorized into delegated permissions, which run on behalf of a signed-in user, and application permissions, which run without a signed-in user.

To safeguard these interactions, developers can implement certificate-based authentication instead of relying on simple client secrets. Using certificate credentials provides a more secure way for the application to prove its identity to Microsoft Entra ID. This trust relationship depends on the application possessing the private key while the public key is uploaded to the app registration.