How to restrict Azure Entra group read permissions for a service principal to specific groups?

I need to query member details for specific Azure Entra groups (e.g., foo-A, foo-B, foo-C) using a Python script with a service principal app.

I have a working prototype in a sandbox Azure account, but the permission Group.Read.All requires admin consent, which grants the script access to all Entra groups in the Azure account. For production deployment, the system admin is concerned about this broad permission.

Is there a way to grant a more restricted permission, so the service principal can only read groups with names starting with "foo-" (e.g., foo-*), without granting access to all groups in the directory?

Note that: Microsoft Graph API permissions are tenant wide and cannot be restricted to specific users or groups.

• GroupMember.Read.All and Group.Read.All application API permissions when granted allows the application to access all groups in the tenant.
• GroupMember.Read.All allows the Entra application to read memberships and basic group properties for all groups.

Hence as a workaround, as suggested by @Thomas, you can add the Microsoft Entra ID application as the owner of the group:

When you add the Microsoft Entra ID application/SP as the owner of the group, then the application can access the group without any API permissions granted to the application:

Theres no need to add any group related API permissions

I am able to access the group successfully with the Microsoft Entra ID application:

tenant_id = 'TenantID'
client_id = 'ClientID'
client_secret = 'Secret'

credential = ClientSecretCredential(tenant_id, client_id, client_secret)

token = credential.get_token("https://graph.microsoft.com/.default")
access_token = token.token

# Define the group ID you want to retrieve
group_id = 'GroupID'

url = f'https://graph.microsoft.com/v1.0/groups/{group_id}'

headers = {
    'Authorization': f'Bearer {access_token}',
    'Content-Type': 'application/json'
}

response = requests.get(url, headers=headers)

if response.status_code == 200:
    group = response.json()
    print("Group Information:")
    print(f"Group Name: {group['displayName']}")
    print(f"Group ID: {group['id']}")
    print(f"Group Description: {group.get('description', 'No description available')}")
else:
    print(f"Error: {response.status_code}")
    print(response.json())

When I tried to access the group where the SP is not added as owner, got 403 error:

Reference:

Limit permissions to update a single Azure AD group via API - Microsoft Q&A by Fraczek, Rafal SW/WRO-DCDZA