An Azure service that provides hosted, universal storage for Azure app configurations.
Graph permissions are tenant wide, although some workloads offer additional restrictions. In the case of SPO, you can use the recently introduced Sites.Selected scope, read here: https://www.michev.info/Blog/Post/3256/limiting-access-to-sharepoint-online-resources-via-the-graph-api