I'm creating a new internal user-delegated Azure AD Application to read from a specific Azure Storage container.
Any users who login to this application should be granted access to this application.
If I use the scope: https://storage.azure.com/user_impersonation then the Access Token can work for all Azure Storage accounts in my tenant.
If I use the scope: https://<my_storage_account>.blob.core.windows.net/user_impersonation then the token only works with my specific account.
But, this scope restriction is being added during auth stage in a web app and can be spoofed.
Some of my users naturally have higher privilege and I don't want these access tokens being abused.
Is it possible to configure the app to restrict the tokens so they can only be used for specific resources?
A similar concept would be when I grant access for an app to view my GitHub repos, I can restrict with repos the app is allowed to see.