More granular application specific Application.Read.All

Question

Is there an alternative available to use a more granular permission than Application.Read.All to read only permission granted to a specific application? We have a customer feedback that ideally there should be a way to only grant permission to an application only read permissions granted to itself. If not possible as of today, is this something under consideration? We're already using app Id as a filter in the API request, but the ask is to not have API return the data without passing the app Id - to avoid the risk of an application accidentally receiving permissions for other applications in the tenant.

Answer 1

Currently, the Microsoft Graph API does not offer a more granular alternative to Application.Read.All for restricting access to only the permissions granted to a specific application. The closest solution available today is filtering results by app ID in your API calls, as you're already doing, but this does not prevent broader access at the permission level.

Consider assigning a dedicated managed identity or creating a separate app registration for each application. This approach isolates permissions at the app level, minimizing risks of accidental exposure.

If feasible, you can create a custom API or proxy layer that interacts with Microsoft Graph on behalf of your app. This API can enforce stricter policies, such as ensuring that only data for the specific application is returned.

Hope it helps