Is it possible to setup Azure based App permissions to only a single Site Collection? We are putting together a small application which will scrape external documents from various sites and dump them to a document library. I've found this doc from MS (as various others) which outline setting up App permissions but all of them require the granting access to ALL site collections. This seems like way too much access to SPO to complete this simple task. Am I missing something?
You can register a sharepoint add-in using the "_layouts/appregnew.aspx" page on the site collection on which you need access. There are various permission levels you can provide to that app on the site collection. You can also enable app-only access so that you can acquire a app-only token and perform an operation on the you need.
Here are a few references to register an app, provide permissions to it
You can "AllowAppOnlyPolicy" in the permission XML https://blogs.msdn.microsoft.com/vesku/2016/03/07/using-add-in-only-app-only-permissions-with-search-queries-in-sharepoint-online/enter link description here
This way you do not need to provide access on all the site collections.