We are building a service where we use AAD to authenticate users. We also have the need to read the groups the user is member of from AAD, so that we can resolve the permissions the user should have in our system (we shadow some of the groups from AAD in our system and have system specific permissions stored on our side). However, what we face is that to query AAD for the permissions of the user, it seems our app needs to have permission of reading all groups (full directory) in AAD.
Question is, how can we make our app privileged in AAD to only read certain groups from the directory?