Microsoft Connector: Overly-permissive scope

[ap0phi5]

Are we able to make this a more granular permission requirement as our team that manages Microsoft Entra is not comfortable delegating Directory.Read.All

If we are only using for auth and group membership, is the following not sufficient?

• user.read
• group.read.all
• groupMember.read.all

References:

From the documentation (https://dexidp.io/docs/connectors/microsoft/)

when registering dex application on https://apps.dev.microsoft.com/ add an explicit Directory.Read.All permission to the list of Delegated Permissions

Coded here:

dex/connector/microsoft/microsoft.go

Lines 37 to 39 in 487717d

	// Microsoft requires this scope to list groups the user is a member of
	// and resolve their ids to groups names.
	scopeGroups = "directory.read.all"