You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph. You need to ensure that the app can access Azure AD. What should you…

A custom role-based access control (RBAC) role is used to manage access to Azure resources, not to provide an application with an identity to access Azure AD via Microsoft Graph.

An external identity refers to users from outside the organization, not the application's own identity within Azure AD.

Azure AD Application Proxy provides secure remote access to on-premises web applications, and does not establish an application's identity for accessing Azure AD or Microsoft Graph.

An app registration in Azure AD provides an identity for an application, allowing it to authenticate with Azure AD. This identity is essential for the application to be granted permissions and access resources like Microsoft Graph to modify user properties.