The configured folder import uses Microsoft Graph app-only access. The folder is pinned by its drive and item IDs in the backend environment; the browser never receives the Microsoft app credential.