How to restrict/limit Azure App Registration API permissions

user_8542 0
Viewed 1654

We have an Azure AD App Registration which calls into Microsoft Graph API using Application rather than Delegated permissions.

Examples of the MS Graph API permissions we've added are:

  • User.Read.All
  • GroupMember.ReadWrite.All

Our goal is to only allow this Application to manage those users and groups within a specific 'Administrative Unit', however we are unable to see how to restrict or scope the above permissions.

Do you know if this is possible and if so how?

microsoft-graph-api azure-active-directory azure-web-app-service
2 Answers

What we ended up doing was:

  • Remove the GroupMember.ReadWrite.All permission from the App registration
  • Customise the User Administrator role from within the Administrative Unit as per screenshot below.
  • As commented by @Clayton when selecting the member (in this case the service principal of the App) you'll need to enter the name exactly (or paste in the App ID) in order for it to appear in the search results.

enter image description here

  • This links the service principal for the app to the User Admin role, but is scoped to the Admin Unit.
  • Restart the app to ensure it picks up new tokens
  • Our testing so far confirms that the app may now only add users to groups which are within this Admin Unit
  • Any attempt to add a user to a different Admin Unit or a group with no Admin unit will fail.

Hope this helps someone (or me in the future!)

user_85420

Use the New-ApplicationAccessPolicy cmdlet to restrict or deny access to a specific set of mailboxes by an application that uses APIs (Outlook REST, Microsoft Graph, or Exchange Web Services (EWS)).

Configure ApplicationAccessPolicy. To configure an application access policy and limit the scope of application permission

1) Connect to Exchange Online PowerShell. For details, see Connect to Exchange Online PowerShell

2) Identify the app’s client ID and a mail-enabled security group to restrict the app’s access to. Identify the app’s application (client) ID in the Azure app registration portal. Create a new mail-enabled security group or use an existing one and identify the email address for the group.

3) Create an application access policy. Run the following command, replacing the AppId, PolicyScopeGroupId, and Description arguments.

Example:

New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "e7e4dbfc-046f-4074-9b3b-2ae8f144f59b" -PolicyScopeGroupId EvenUsers@AppPolicyTest2.com -Description "Restrict this app's access to members of security group EvenUsers."

This example creates a new application access policy with the following settings:

AccessRight: RestrictAccess, AppIDs: e7e4dbfc-046f-4074-9b3b-2ae8f144f59b, PolicyScopeGroupId: EvenUsers@AppPolicyTest2.com, Description: Restrict this app's access to members of security group EvenUsers.

4) Test the newly created application access policy. Run the following command, replacing the AppId and Identity arguments.

Test-ApplicationAccessPolicy -Identity user1@contoso.com -AppId e7e4dbfc-046-4074-9b3b-2ae8f144f59b

The output of this command will indicate whether the app has access to User1’s mailbox

For more details refer these link1 and link2

user_159702330
Related