Limit access to groups or individual mailboxes using a service application in Azure Ad

Question

I have an Azure integrated service application (daemon app) with permissions to the Microsoft graph api, I can now read all the mailboxes for the entire company, which is aw

Answer 1

The daemon app which use the client credential to acquire the access token.

The client credential flow is used to as an authorization grant typically when the client is acting on its own behalf. And it is not able to specify mailboxes that the app can have access.

You can achieve this by implement the business logic in the daemon app.