SharePoint Online permission control for Azure AD service principal OAuth

Question

I'm building a web application that uses OData to retrieve data from SharePoint Online lists.

The authentication I choose is Azure AD service principal OAuth. I do not choose user interactive way because refresh token expiration is annoying.

I refer to this doc Granting access via Azure AD App-Only and it works but I'm concerned about the permission control.

According to the doc, the scope of the listed application permission is Allsites which means the application would be able to access all the sites under my tenant. So how can I set site level (or list level even better) permissions to the application?

Answer 1

I don't think you can't. As far as I know site, list & item permissions are only meant for users.

You could use the SharePoint App only permissions. That's restricted to a site collection. https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs Although I would refrain from using this methods as the ACS mechanisme doesn't have a bright future.