Restriction on Graph API operations

Question

Hello Experts.

We have a hybrid MS integration in place. On-prim AD is sync'd with Azure AD.

We are in the process of integrating SailPoint solution for identity governance with our MS Tenant.

We do not have a testing environment. Therefore, we'd like to test a few use-cases (revoke access, update attribute, mailbox creation, etc.) in our MS tenant directly. However, we do not want the Sailpoint to have "write" capabilities on all users in the tenant.

Is there a way the integration scope can be restricted to a set of users only?

Regards

Answer 1

That depends on the application, the permissions model used and the workload(s) it access. Generally speaking, Graph API permissions within the application permissions model are directory-wide, unrestricted. Some workloads however do offer additional controls that can restrict such access, i.e. Application access policies for Exchange or the recently announced RBAC for applications: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-public-preview-of-role-based-access-control-for/ba-p/3688228

Teams has the Resource-scoped consent model, whereas on the SharePoint side, the Sites.Selected method can do the same: https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

If the application is using the delegate permissions model instead, the effective permissions it gets are restricted to that of the user/service principal under which it runs.