Limit permissions to update a single Azure AD group via API

Question

We have a requirement where we want to use an automation to add users to a specific group in Azure AD via API calls. Our security policies require us to apply the principle of least privilege when doing this, meaning that we should only provide permissions to update that specific group in AAD.

When configuring the application in Azure and requesting the API permissions, there's only the possibility to add Group.ReadWrite.All and GroupMember.ReadWrite.All permissions, but no way to limit this to a specific group only.

Is there a way to setup permissions to allow an automation access to a single group in Azure AD only via API calls?

Best regards,
Pascal Frencken
Signify

Answer 1

Hi @Pascal Frencken ,

Currently most of the Graph permissions are tenant-wide, without a way to restrict them for a specific group. Group.ReadWrite.All and GroupMember.ReadWrite.All give access to all the groups at Application level.

Similar Post: https://learn.microsoft.com/en-us/answers/questions/466029/microsoft-graph-permissions-to-only-access-specifi.html

You can submit a feature request idea which will be monitored by Microsoft team and make the enhancements to Microsoft Graph APIs.

Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

Maybe this time answer will not be deleted :D

One of the options is to set the Service Principal as the Owner of required groups that SP should be able to manage. The fact that SP will be the owner of the group gives him the ability to add and remove users and owners from them. With this setting, the application does not need to have any API permissions to manage groups Group.ReadWrite.All or Group.Read.All. Being the owner of restricted number of groups, allow SP only to read/change those groups and for others where SP is not an owner we will have error 403 Forbidden access.

Additional option is to create Administrative Unit and add required groups to it. Then create new Custom Role with permission to read or update members as required for example microsoft.directory/groups.security.assignedMembership/members/update

Then in Administrative Unit we need to navigate to 'Roles and administrators' select our new Custom role and as member add Service Principal which should have the rights to manage this AU (so also manage groups assigned to it, as AU will be selected in Scope during assignment). (side not as for now we need to assign new Custom role from AU, not from Role view as selection of AU is not available in Scope during role assignment).