A service provider is currently implementing Azure Active Directory login for the client application we are using. They plan to create application user accounts for our AAD users and give them application permissions depending on their AAD group memberships.
For that they registered a multi-tenant Application in Azure AD which I will grant permissions in our Directory.

To be able to fetch groups and users from the customers directory the App needs the following permissions for Microsoft Graph Api:

  • Group.Read.All
  • User.Read.All

But, as only some of our users will use the application and only some of our security groups will be used to control access to the application I don't want the application to get information about all our groups and all our users.

Is there a way to restrict the Graph Api result to only a defined subset of the objects available in the directory?
Or is there another Api they should use instead of Microsoft Graph Api to request that information?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.