Create Azure AD App Only to authenticate our asp.net core console application

Question

I want to create an Azure AD App Only to authenticate our console application which run on schedule bases and update some SharePoint online sites' lists and libraries. now i am following those steps @ https://sharepointstew.wordpress.com/2021/07/07/app-only-authentication-in-sharepoint-online-using-latest-azure-sdk/

Where i created an app registration inside Azure AD

and then inside the API permissions >> I wanted grant permission for SharePoint. but i got those messages:-

so should i depend on Graph API ONLY and not create a separate permission for SharePoint ?

Second question, Also should i use delegated permission or app permission? and why?

Thanks

Answer 1

Microsoft Graph vs SharePoint Client Object Model or REST API

Microsoft Graph doesn't have full parity with the SharePoint Client Object Model or REST API. If you're just updating items in SharePoint lists or libraries then you'd probably be OK using Microsoft Graph, but there's still a chance you'll need to do something not supported by Microsoft Graph. My suggestion would be to stick with the SharePoint Client Object Model or REST API for now.

Application Permissions vs Delegated Permissions

Application (app-only) permissions are used in two scenarios. First, when there is no current user. For example, when you have an Azure Function running on a timer. Second, when you want to elevate permissions. For example, you want your application to be able to create a new list but you know that some of the users of your application may not have permissions to do so.

When using application permissions, the permissions of the app are the only thing taken into account when a request is made to SharePoint. If the app has been granted the necessary permissions, the request will succeed.

When using delegated permissions, both the user and the app must have been granted the necessary permissions for a request to succeed. For example, if you want to create a list the both the app and the users must have been granted the necessary permissions to create a list or the request will fail.