I'm building a web application that uses OData to retrieve data from SharePoint Online lists.
The authentication I choose is Azure AD service principal OAuth. I do not choose user interactive way because refresh token expiration is annoying.
I refer to this doc Granting access via Azure AD App-Only and it works but I'm concerned about the permission control.
According to the doc, the scope of the listed application permission is Allsites which means the application would be able to access all the sites under my tenant. So how can I set site level (or list level even better) permissions to the application?