In Microsoft Entra (Azure AD) app registrations, permissions are categorized as either delegated or application.
* Delegated permissions are used when an app acts on behalf of a user who is signed in.
* Application permissions are used when an app acts as itself, without user interaction - typically for background services, daemons, or APIs.
Because App1 is a service application that will:
* Run without user interaction,
* Access the Microsoft Graph API, and
* Collect audit logs (sign-in logs) -
It requires application permissions such as AuditLog.Read.All or Directory.Read.All granted to the app identity itself.
Microsoft documentation states:
"Applications that run as background services or daemons use application permissions when calling Microsoft Graph APIs that access organization data without a signed-in user."