How do I limit an applications access to specific information?-application security

Question

How do I limit an applications access to specific information?-application security

Rex Smith 0

How do I limit an applications access to specific information?

Jose Benjamin Solis Nolasco 7,376 Reputation points

2026-02-16T17:37:42.3166667+00:00

Welcome to Microsoft Q&A

Hello Rex Smith,

Great question. By default, giving an app "Read Access" often gives it read access to everything, which is dangerous. You can limit this, but the "how" changes depending on what data you are protecting and what kind of app you are referring to
Rex Smith 0 Reputation points

2026-02-16T17:53:40.8266667+00:00

We are creating an AI assistant that will evaluate incoming sales quotes. It needs to have access to a pricing spreadsheet, but only that file on Sharepoint. Under Graph I have setup Channel.Message.Send, Files.Read, Mail.Read, offliine_access. I only want it to see the files I authorize, only a specific email account etc.
VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-18T08:22:43.54+00:00
Rex Smith To limit an application’s access to specific information, you must enforce the principle of least privilege at both the identity and data layers.

Key approaches:

Use scoped permissions

Grant only the minimum required API permissions/scopes (for example, Microsoft Graph User.Read instead of User.Read.All).

Prefer delegated permissions over application permissions whenever possible.

App roles and role-based access control (RBAC)
- Define app roles and assign users or groups to those roles so the app can only access authorized data. - Use RBAC to restrict what actions the app can perform.

Consent control

Disable user consent and require admin consent for sensitive permissions.

Regularly review granted permissions and remove unused ones.

Conditional Access and policies
- Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.). - Limit access to specific users, groups, or service principals. Data‑level restrictions - Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering). - Use DLP and information protection to prevent data exfiltration.

Monitor and audit

Enable sign‑in logs, audit logs, and review app activity regularly to detect over‑permissioned access.
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:57:54.67+00:00
Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.).

Limit access to specific users, groups, or service principals.

Data‑level restrictions
- Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering). - Use DLP and information protection to prevent data exfiltration.

Header 1 Header 2

Cell 1 Cell 2

Cell 3 Cell 4
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:58:06.09+00:00
Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering).

Use DLP and information protection to prevent data exfiltration.
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:58:24.6266667+00:00

https://learn.microsoft.com/en-us/users/na/?userid=ada4b56f-71b2-4127-885c-0168800ecba2

Your answer

Jose Benjamin Solis Nolasco 7,376 Reputation points

2026-02-16T17:37:42.3166667+00:00

Welcome to Microsoft Q&A

Hello Rex Smith,

Great question. By default, giving an app "Read Access" often gives it read access to everything, which is dangerous. You can limit this, but the "how" changes depending on what data you are protecting and what kind of app you are referring to
Rex Smith 0 Reputation points

2026-02-16T17:53:40.8266667+00:00

We are creating an AI assistant that will evaluate incoming sales quotes. It needs to have access to a pricing spreadsheet, but only that file on Sharepoint. Under Graph I have setup Channel.Message.Send, Files.Read, Mail.Read, offliine_access. I only want it to see the files I authorize, only a specific email account etc.
VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-18T08:22:43.54+00:00

Rex Smith To limit an application’s access to specific information, you must enforce the principle of least privilege at both the identity and data layers.

Key approaches:

Use scoped permissions

Grant only the minimum required API permissions/scopes (for example, Microsoft Graph User.Read instead of User.Read.All).

Prefer delegated permissions over application permissions whenever possible.

App roles and role-based access control (RBAC)
- Define app roles and assign users or groups to those roles so the app can only access authorized data. - Use RBAC to restrict what actions the app can perform.

Consent control

Disable user consent and require admin consent for sensitive permissions.

Regularly review granted permissions and remove unused ones.

Conditional Access and policies
- Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.). - Limit access to specific users, groups, or service principals. Data‑level restrictions - Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering). - Use DLP and information protection to prevent data exfiltration.

Monitor and audit

Enable sign‑in logs, audit logs, and review app activity regularly to detect over‑permissioned access.
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:57:54.67+00:00

Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.).

Limit access to specific users, groups, or service principals.

Data‑level restrictions
- Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering). - Use DLP and information protection to prevent data exfiltration.

Header 1 Header 2

Cell 1 Cell 2

Cell 3 Cell 4
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:58:06.09+00:00

Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering).

Use DLP and information protection to prevent data exfiltration.
MirsjerkGlobal-4608 0 Reputation points

2026-02-18T10:58:24.6266667+00:00

https://learn.microsoft.com/en-us/users/na/?userid=ada4b56f-71b2-4127-885c-0168800ecba2

Header 1	Header 2
Cell 1	Cell 2
Cell 3	Cell 4

Share via

How do I limit an applications access to specific information?-application security

Your answer