Limit permissions to update a single Azure AD group via API

Question

We have a requirement where we want to use an automation to add users to a specific group in Azure AD via API calls. Our security policies require us to apply the principle of least privilege when doing this, meaning that we should only provide permissions to update that specific group in AAD.

When configuring the application in Azure and requesting the API permissions, there's only the possibility to add Group.ReadWrite.All and GroupMember.ReadWrite.All permissions, but no way to limit this to a specific group only.

Is there a way to setup permissions to allow an automation access to a single group in Azure AD only via API calls?

Best regards,
Pascal Frencken
Signify

Answer 1

Hi @Pascal Frencken ,

Currently most of the Graph permissions are tenant-wide, without a way to restrict them for a specific group. Group.ReadWrite.All and GroupMember.ReadWrite.All give access to all the groups at Application level.

Similar Post: https://learn.microsoft.com/en-us/answers/questions/466029/microsoft-graph-permissions-to-only-access-specifi.html

You can submit a feature request idea which will be monitored by Microsoft team and make the enhancements to Microsoft Graph APIs.

Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.