How Can We Limit User Access to MGGraph for Better Security?

You're right about standard users being able to look up all users in the directory; that's how it's designed to function. It’s more about the services needing that access rather than a flaw in the system. Instead of trying to block access, focus on reducing the risk of accounts getting compromised in the first place.

You can't totally avoid get-mguser commands, but you can tweak some permissions. In the Microsoft Entra admin center, change the setting so only admins can give Graph permissions. This helps a bit to restrict unwanted access.

Even if you try to block access via PowerShell, realize that users can still grab this info in other ways, like through Outlook's cached global address list. The best bet is to focus on solid security practices like least privilege access and MFA instead of just hiding user data.

To limit access without breaking everything, you might consider disabling non-admin access to the Azure Portal and managing group access more strictly. There's also conditional access for mgGraph PowerShell which could help.

Unfortunately, you can’t completely restrict access to user data as it’s necessary for many services. Instead, consider using security tools that monitor unusual activity. If a user is suddenly querying a lot of data, it can trigger alerts for quick action.