Azure AD App Application Permissions vs Delegated Permissions

You typically use delegated permissions when you want to call the Web API as the logged on user. Say for example that the Web API needs to filter the data it returns based on who the user is, or execute some action as the logged in user. Or even just to log which user was initiating the call.

Application permissions are used when the application calls the API as itself. For example to get the weather forecast for a certain zipcode (it does not matter which user is logged on). The client can even call the API when there's no user present (some background service calling the API to update some status).

From the documentation here: Configure a client application to access web APIs:

• Application Permissions: Your application needs to access the web API directly as itself (no user context). This type of permissionrequires administrator consent and is also not available for nativeclient applications.
• Delegation Permissions: Your application needs to access the web API as the signed-in user, but with access limited by the selectedpermission. This type of permission can be granted by a user unlessthe permission is configured as requiring administrator consent.

Based on this if your application requires user impersonation, then you would need to use Delegation permissions.