
Explanation:
Box 1: A Conditional Access policy
To restrict access to a Microsoft Entra app registration with Microsoft Graph application permissions to only the corporate network, Conditional Access policies are used. These policies allow administrators to define rules based on various conditions, including network location, to control access to resources.
Box 2: User-assigned managed identity
It is possible to use a managed identity to configure non-interactive scheduled tasks on an on- premises server to authenticate with an application that has Microsoft Graph application permissions within a Microsoft Entra tenant. This involves leveraging a user-assigned managed identity, granting it the necessary permissions to access Microsoft Graph, and then configuring the scheduled task to utilize that identity for authentication.
Reference:
https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-configure-permissions
https://docs.azure.cn/en-us/app-service/configure-authentication-provider-aad