Explanation:
Box 1: user_impersonation
The built-in user_impersonation scope indicates that the token is being requested on behalf of the user. Azure Storage exposes a single delegation scope named user_impersonation that permits applications to take any action allowed by the user.
Box 2: delegated
Example:
1. Select the API permissions section
2. Click the Add a permission button and then:
Ensure that the My APIs tab is selected
3. In the list of APIs, select the API TodoListService-aspnetcore.
4. In the Delegated permissions section, ensure that the right permissions are checked:
user_impersonation.
5. Select the Add permissions button.
Box 3: delegated
Example
1. Select the API permissions section
2. Click the Add a permission button and then,
Ensure that the Microsoft APIs tab is selected
3. In the Commonly used Microsoft APIs section, click on Microsoft Graph
4. In the Delegated permissions section, ensure that the right permissions are checked:
User.Read. Use the search box if necessary.
5. Select the Add permissions button
Reference:
https://stackoverflow.com/questions/31404128/azure-ad-app-application-permissions-vs-delegated-permissions
https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent
https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet
https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory