Reference:
https://docs.microsoft.com/en-us/graph/permissions-reference

Topic 1, Contoso
Existing Environment
Microsoft 365
Contoso identifies the following business goals:
* Utilize core functionality of apps whenever possible.
* Reduce app development costs.
* Minimize training costs for end users.
Microsoft SharePoint/Microsoft Exchange
Contoso has a Microsoft 365 subscription that uses a domain named contoso.com. Each user is assigned a Microsoft 365 Enterprise E5 licence.
Problem Statement
Contoso moves all email accounts to Microsoft 365.
Contoso migrates the SharePoint Server 2013 intranet sites of the research department to SharePoint Online.
Requirements
Business Goals
Contoso identifies the following issues:
* Users in the sales department report that prepanng quotations is time-consuming as it requires manually copying and pasting data from multiple sources.
* Users in the HR department must use multiple apps to manage the hiring process.
* The solution to claim expenses requires multiple manual steps.
Planned Changes
Contoso identifies the following business goals:
* Utilize core functionality of apps whenever possible.
* Reduce app development costs.
* Minimize training costs for end users.
Technical Requirements
Contoso plans to implement the following changes;
* Redesign the SharePoint Online sites of the research department to provide users with an expenence that is consistent with the Microsoft 365 portal. The research department has a third-party project management solution that uses the Microsoft identity platform in Azure AD.
* Create an email workflow solution for expense claims. Users will submit their expense claims and the system will email an approval request to their manager.
* Implement a bring your own device (BYOD) model that supports Windows 10, macOS, and Android devices.
* Develop a custom Microsoft 365 app named SalesApp for the sales department.
* Develop a custom Microsoft 365 app named HRApp for the HR department
Security Requirement
Contoso identifies the following technical requirements for app development:
* The expense claims solution must provide managers with claim information and the ability to manage the claim by using Microsoft Outlook. Outlook on the web, or Outlook for iOS and Android.
* HRApp must include a bot named HRBot that will answer HR questions. Users must be able to access the bot by mentioning HRBot in a Microsoft Teams channel or private chat.
* HRApp must enable users to query a third-party HR system by using a tab from within a Microsoft Teams channel.
* HRApp must include a messaging extension that enables users to search jobs by job title or job ID.
* SalesApp must be integrated with Microsoft Word and must combine images and text from multiple sources to create a quotation as a DOCX file.
* The distribution of SalesApp must be automatic and require minimal user interaction.
* Solutions for SharePoint Online and Microsoft Office must follow the current Office user interface (Ul) design.
* Development tools and solutions must support Windows and non-Windows devices.
* Development effort must be minimized.
HRApp Manifest
All solutions must support the Microsoft identity platform in Azure AD.
Intranet components must not share access tokens.

You can test an Office Add-in in an Office client that is on Windows by publishing the manifest to a network file share.
Reference:
https://docs.microsoft.com/en-us/office/dev/add-ins/testing/create-a-network-shared-folder-catalog-for-task-pane-and-content-add-ins

Explanation
Microsoft Graph Calendars.Read allows the app to read events in user calendars.
For your app to access data in Microsoft Graph, the user or administrator must grant it the correct permissions via a consent process.
Application permissions are used by apps that run without a signed-in user present; for example, apps that run as background services or daemons. Application permissions can only be consented by an administrator.
References: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent
https://docs.microsoft.com/en-us/graph/permissions-reference