Restrict resources access in office 365 during OAuth

Question

We have a web application that OAuth with Office 365 using Azure AD. We are trying to restrict the resources we have access to. Example: The authentication user have access to Site1, Site2 and Site3. We want to limit our application access to Site1 only. Does any one know if this is possible? I tried to go over Office 365, Azure AD and even Discovery API documentation, but I couldn't find anything helpful.

Fei Xue - MSFT Fei Xue - MSFT · Accepted Answer · 2016-05-24T09:40:40

Did you also register the site1, site2 and site3 on the Azure AD? If I understood correctly, we can config the app manifest for the site1, site2 and site 3 to set the require permission like below(refer to here)

"oauth2Permissions": [
{
    "adminConsentDescription": "Allow the application full access to the Todo List service on behalf of the signed-in   user",
    "adminConsentDisplayName": "Have full access to the Todo List service",
    "id": "b69ee3c9-c40d-4f2a-ac80-961cd1534e40",
    "isEnabled": true,
    "type": "User",
    "userConsentDescription": "Allow the application full access to the todo service on your behalf",
    "userConsentDisplayName": "Have full access to the todo service",
    "value": "user_impersonation"
    }
],

Then we need to assign the web app with right permission as the Microsoft build service like figure below:

The last step is that site1, site2, site3 need to verify whether the request has the permission to visit the resource via analyze the scope in the access token.

Restrict resources access in office 365 during OAuth

2 Answers