Restrict Azure Enterprise Application access by App-ID

Question

i am looking fo a way to restrict an enterprise application in Azure to only access certain data in M365 SharePoint. The app itself is externally hosted using OIDC and requests "offlice_access_scope".

I would like to restrict access of this application to a specific SharePoint (M365) Site. Is there a way to do so - or am I completly wrong?

Answer 1

Looking at this article: Granting access via Azure AD It would seem that this isn't possible as you can not give specific access scopes in Azure. Further to this the way Dynamics implements this is application users which do not exist in Sharepoint.

SharePoint Online permission control for Azure AD service principal OAuth This post references a possible way to do it but it is using SharePoint App-Only which is not being used here from what I can see.