Is there any way , by using a service principal , to allow visibility only to a desired subset of Microsoft Entra ID?

Question

The retrieval of information , containing the groups and users belonging to Microsoft Entra ID is done through Graph API using service principal which authorizes the following permissions: 
User.Read.All , Group.Read.All

The service principal allows to retrieve global information of users and groups existing in the Azure tenant. In this case , there is a need to retrieve a subset of this information.
However filtering the information is not a solution for this case as it is a requirement that there is no access to groups and users outside the desired subset. In addition a solution through the use of Administrative units has been considered , where in this case visibility to groups and users could be allowed by choice (with the appropriate permissions) but there is a limitation in the part of assigning each user to the group he/she belongs to as this requires additional permission for User.Read.All or Group.Read.All.
(https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units)

Is there any way for the service principal to allow visibility only to the desired subset of groups and their members?

Answer 1

There isn't, you cannot currently scope down read-only directory permissions.