Can delegated permissions be used instead, assuming the service account is the one initiating and managing events? This would help avoid tenant-wide access and reduce security exposure.