Exam MS-600 topic 1 question 21 discussion

DRAG DROP -
You are building an API that will return a user's documents from a Microsoft SharePoint Online site.
You need to ensure that the API can use the Microsoft Authentication Library (MSAL) to access the SharePoint site. The solution must use the principle of least privilege.
Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct orders you select.
Select and Place:

Suggested Answer:
Step 1: From Azure Active Directory admin center, register an app and create a client secret
Register your application in Azure AD. Service-to-service calls require that your application use an X.509 certificate to create client assertion in the form of a base64-encoded, SHA256 signed JWT bearer token.
Generate a new key for your application. Keys, also known as client secrets, are used when exchanging an authorization code for an access token.
Step 2: From the Azure Active Directory admin center, grant the Sites.Read.All delegated permission to the app.
Delegated Permissions. Enables your client app to perform operations on behalf of the signed-in user, such as reading email or modifying the user's profile.
Incorrect Answers:
✑ Application Permissions. Permissions that enable the client app to authenticate as itself without user interaction or consent, such as an app used by background services or daemon apps.
Step 3: From the API code, configure the MSAL.
When have registered your app in Azure AD and configured it with the necessary permissions, you're ready to build your app.
Reference:
https://docs.microsoft.com/en-us/office/office-365-management-api/get-started-with-office-365-management-apis