title: How to restrict/limit Azure App Registration API permissions
body: <p>We have an Azure AD App Registration which calls into Microsoft Graph API using Application rather than Delegated permissions.</p>
  <p>Examples of the MS Graph API permissions we've added are:</p>
  <ul>
  <li>User.Read.All</li>
  <li>GroupMember.ReadWrite.All</li>
  </ul>
  <p>Our goal is to only allow this Application to manage those users and groups within a specific 'Administrative Unit', however we are unable to see how to restrict or scope the above permissions.</p>
  <p>Do you know if this is possible and if so how?</p>