How to restrict app permissions to a set of API endpoints

Ahtesham Patel 41 Reputation points
2022-09-20T12:11:52.107+00:00

I have registered an app in Azure AD without any API permissions
243032-image.png

Post that I have assigned "Reader Role" to this APP in one of the subscriptions. I am using this to access the below API endpoints

GET https://management.azure.com/subscriptions?api-version=2020-01-01
GET https://management.azure.com/subscriptions/{subscriptionId}/resources?api-version=2020-06-01
GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/assessments?api-version=2020-01-01
GET https://management.azure.com/subscriptions/{subscriptionId}/locations?api-version=2020-01-01

Is there a way for me to restrict the access to only the above API's and make sure the APP credentials are not used to access any other endpoints?

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Carlos Solís Salazar 18,291 Reputation points MVP Volunteer Moderator
    2022-09-20T12:42:57.823+00:00

    Hi @Ahtesham Patel

    Thank you for asking this question on the **Microsoft Q&A Platform. **

    Is there a way for me to restrict the access to only the above API's

    The App registration only allows those permissions that you define in the API permission section.

    make sure the APP credentials are not used to access any other endpoints?

    Conditional access for App Registration is not available so, the only way that you must protect the use of that App Registration is through the Certificates & Secrets

    Hope this helps!

    ----------

    Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
    NOTE: To answer you as quickly as possible, please mention me in your reply.


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.