How do I limit an applications access to specific information?-application security

Welcome to Microsoft Q&A

Hello Rex Smith,

Great question. By default, giving an app "Read Access" often gives it read access to everything, which is dangerous. You can limit this, but the "how" changes depending on what data you are protecting and what kind of app you are referring to

We are creating an AI assistant that will evaluate incoming sales quotes. It needs to have access to a pricing spreadsheet, but only that file on Sharepoint. Under Graph I have setup Channel.Message.Send, Files.Read, Mail.Read, offliine_access. I only want it to see the files I authorize, only a specific email account etc.

Rex Smith To limit an application’s access to specific information, you must enforce the principle of least privilege at both the identity and data layers.

Key approaches:

Use scoped permissions

• Grant only the minimum required API permissions/scopes (for example, Microsoft Graph User.Read instead of User.Read.All).
  • Prefer delegated permissions over application permissions whenever possible.
  App roles and role-based access control (RBAC)

  - Define app roles and assign users or groups to those roles so the app can only access authorized data.
  
     - Use RBAC to restrict what actions the app can perform.
  

Consent control

• Disable user consent and require admin consent for sensitive permissions.
  • Regularly review granted permissions and remove unused ones.
  Conditional Access and policies

  - Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.).
  
     - Limit access to specific users, groups, or service principals.
  
     Data‑level restrictions
  
        - Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering).
  
           - Use DLP and information protection to prevent data exfiltration.
  

Monitor and audit

• Enable sign‑in logs, audit logs, and review app activity regularly to detect over‑permissioned access.

• Apply Conditional Access to control when and how the app can access data (device compliance, location, MFA, etc.).
  • Limit access to specific users, groups, or service principals.
  Data‑level restrictions

  - Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering).
  
     - Use DLP and information protection to prevent data exfiltration.
  

• Enforce filtering and access checks within the application itself (for example, tenant, user, or attribute‑based filtering).
  • Use DLP and information protection to prevent data exfiltration.