App1 needs permission to read all user calendars and create appointments. To grant least-privilege access via the app registration, what should you add?

The correct answer is to add an Application API permission Microsoft.Graph Calendars.ReadWrite. Application permissions are used when an application needs to access data without a signed-in user, such as a background service or daemon. Since App1 needs to read all user calendars and create appointments, it requires this broad access, which is characteristic of application permissions. Delegated permissions (like Calendars.ReadWrite or Calendars.ReadWrite.Shared) are used when an application acts on behalf of a signed-in user, and the permissions are limited by what the user can access. "Grant admin consent" is an action taken after permissions are configured, not a permission itself.