title: Security Around Microsoft Azure AD AD "Application Access"
body: <p>I have successfully configured qn <a href="https://docs.microsoft.com/en-us/graph/auth-v2-service?view=graph-rest-1.0" rel="nofollow noreferrer">Azure AD App Registration</a>, allowing a <code>client_credentials</code> based OAuth 2.0 flow to work. This allows a third party application to access Microsoft Graph API. The app has "<a href="https://docs.microsoft.com/en-us/graph/permissions-reference?view=graph-rest-1.0#calendars-permissions" rel="nofollow noreferrer">Calendar.Read</a>" permission. Meaning the app can pretty much read any of the calendars (including CEO's). </p>
  
  <p>I now have a conversation with security.  What is out there in the Microsoft world, that I can use to lock down usage of API access via this Application Permission?  Is there ability to do things like:</p>
  
  <ul>
  <li>Restrict IP ranges the App can be accessed from?</li>
  <li>Restrict users that can access the App?  (However in Client_credentials, there is no user context)</li>
  <li>Log traffic / activity happening via the App?</li>
  </ul>
  
  <p><em>The only thing i can think of now is to say the Redirect URL configuration on the app means, no other application can get an access token using the Client_credentials, even if the application id &amp; passkey get compromised</em></p>
  
  <p>Any advice on further security controls that can be put in place?</p>