O365 and OAuth2 allows users to give 3rd party apps consent to access data on behalf of the user.
Is there any way we can limit the "scope" of consent the user allow ?
Since we are in the EU, and thus hit by GDPR, and we consider e-mails as containing personal data, then we can not legally allow 3rd parties access to users e-mail without a data processor agreement, risk assessment etc in place. The 3rd party would process data.
We can get the granted permissions on a per user basis, and do our own reporting and followup. But it would be better to say users can NOT give 3rd party apps any sort of e-mail, calendar and Contacts (that is by definition personal data) permission.
We can disallow all 3rd party apps altogether, by tuning integrated Apps off. But we still would allow the user to grant simple consent like: "openid profile email", "User.Read openid email profile offline_access" or "User.Read"
