Restrict Microsoft Graph API permission

Question

Hello,

one of the applications in the tenant needs permissions to the Graph API AppRoleAssignment.ReadWrite.All with the Application type in order to automatically manage AppRoles assignment in the application. However, these permissions pose a high security risk because we give the application the ability to manage appRoles in any application in our tenant.

Is it possible to limit API access so that it only applies to the application for which it was granted? So that the application can manage appRoles that are existing in it, and not in other applications in the tenant.

Thanks in advance

Rafal Fraczek

Answer 1

okay, I have found the solution. maybe someone will need it:

Application need to have Graph API permission: User.Read.All and Application.Read.All with Application Type.

Then we assign Custom Role to ServicePrincipal with permission: microsoft.directory/servicePrincipals/appRoleAssignedTo/update

and scope it during assignment to this SP.

With this, SP is able to modify AppRole assignment for himself but not in different SP's (if required you can add more assignment to different SP's).

Configuring permissions via CustomRole to use Get-MgUser is more complicated as user object has a collection of different objects to which rights are also required to complete the Get-MgUser query (e.g Sign-In logs), that's why I used Graph API permission User.Read.All.

So in general Enterprise App will have rights to use Graph cmds granted via API permission and via Custom role/Built-in role in 'Role and administartors'.

Additional info if we add AppRoleAssignment.ReadWrite.All to API permission and have Custom Role also assigned to SP, access will not be restricted and SP will be able to modify appRole assignment in different SP's.

Answer 2

Afaik no, you cannot restrict said permission. Instead, consider creating a custom role and scope in to just the application at hand. Here's the relevant documentation: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/quickstart-app-registration-limits