Investigate minimal AAD API permissions - such as User.ReadBasic.All

Description

When app registration are created we want to do this with the lowest possible permissions to reduce perceived risk.

We are using Directory.Read.All - this is required to work out which workspaces/app registrations a user is a member off. Can we do this another way? - If we add groups to the app reg roles - could use GroupMember.Read.All - this call is deemed low risk.

Or as a start I believe: Application.Read.All and AppRoleAssignment.ReadWrite.All will work instead of Directory.Read.All and User.ReadBasic.All.

The graph call is only needed for listing workspaces. In certain circumstances where there is no requirement to list workspaces the users could be given URL to the workspace without the need to list all workspaces - or use the my app portal.

See: (https://docs.microsoft.com/en-us/graph/permissions-reference)[https://docs.microsoft.com/en-us/graph/permissions-reference]

Acceptance criteria

• Minimal permissions figured out
• Permissions changes implemented
• Changes updated in /docs/auth.md and other relevant pieces of documentation