How to limit Entra ID App registration API permissions to specific resources

Question

Hi Team,

Currently we are reviewing all Entra ID App registration API permissions. We found 100+ apps with tenant wide API permissions, e.g. Group.ReadWrite.All, Application.ReadWrite.All. We are mainly concerned with Write.All permissions. Is there a way to limit these permissions to specific resources, e.g. specific groups, applications?

Also, is there a way to find what permissions the app requires exactly since many apps are overly permitted, last time we had to contact Azure support and they checked from the backend the specific permissions the App requires.

Answer 1

For apps accessing data on behalf of signed-in users (delegated access, authorized with delegated permissions), your best option is (like @Andy David - MVP mentions), to limit which users can sign into the app, which will limit which user's data (and data accessible by those users) the app can access.

For apps accessing data directly (direct/app-only access, authorized with app roles (application permissions) and other flavors of authorization grants and role assignments), you have some alternative authorization options, depending on the type of data being accessed:

• For apps accessing Exchange data (mail, contacts, calendar), you can assign the app access to only certain mailboxes: Role Based Access Control for Applications in Exchange Online)
• For apps accessing SharePoint sites, you can authorize an app to only access specific sites: Controlling app access on a specific SharePoint site collections
• For Teams apps accessing team and chat data, apps can request access to only the team or chat they're installed in: Resource-specific consent for your Teams app.
• For apps accessing directory data (users, groups, apps, service principals), you can assign some directory roles at the scope of an administrative unit (AU) of objects, or at the scope of individual objects. You can also make an app's service principal owner of a group, an app, or a service principal.

Note that many of these approaches require working with the app publisher/owner/developer, to ensure the app can still function as required.

Answer 2

Its hard to know not knowing what these apps do and there is no way we would know what permissions the apps actually require. If you feel they are over permissioned, remove that perm and see if that breaks things.

I would also suggest restricting the apps to specific users/service principals to start, but this is going to take some work on your part to track down the usage of each:

https://learn.microsoft.com/en-us/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users

Going forward, restrict who can consent apps and enforce strict permissions requirements

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow