Your appapp-only token
MULTI ADMIN APPROVAL
Microsoft Graph
/deviceManagementScripts
GET
POST
GET · read
200 OK
POST · write
403 ApprovalRequired
queued · needs review
MAA gates writes, never reads — a read-only layer is never in its blast radius.