Microsoft Exam MS-600 Topic 16 Question 31 Discussion

By default, the service principal has no explicit permissions granted to access the Microsoft Graph. However, if you request an access token for the Microsoft Graph, you get a token with the user_impersonation permission

scope that can be used for reading information about the users (that is, User.Read.All).