Azure Service Principal to read few Azure AD groups(not all)

Question

How to grant an Azure Service Principal access to read few specific Azure AD groups(not all).

Do we need to give the api permission (directory read all) but this we dont want to give,

any other least privileges' role that we can give on the group level ? like adding SP as member or owner of group?

Answer 1

There a few options:

https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users

or use a delegated access for the SP and administrative groups perhaps.

Otherwise, there is no built-in easy button like you have for scoping access to an Exchange Mailbox for example.