Azure AD Enterprise app should not see all my users/groups. How?

Question

I have granted admin access for enterprise app (using "Grant permissions to an application" like described here https://learn.microsoft.com/en-us/graph/security-authorization#grant-permissions-to-an-application ). So now this app has access to all my groups and users, because of permissions like "Group.Read.All" and "User.Read.All". Is it possible somehow to limit this access for app, so this app will get a limited list of users/groups? I mean if app will request graph api like "/users" or "/groups" - there will be only those items that I want.

Answer 1

No, it can access all the groups and there's no way to restrict it. Only Exchange Online currently offers some controls, as detailed here: https://practical365.com/exchange-online/application-access-policies-in-exchange-online/
For all the other workloads, access cannot be restricted, although supposedly Microsoft is working on bringing additional controls.