I am trying to find security best practice on App permissions in the context of azure resource management.

Currently, there is only one permission listed for management.azure.com and it is
management.azure.com/user\_impersonation (preview). This delegated user impersonation can be a serious problem and it can led to account takeover by malicious app. 

Think about a scenario where a user with global administrator role consent and authorize an access token to the app. App can use the token and do whatever it wants with the azure tenant.

Another scenario where a privileged user assigned contributor role to multiple subscriptions. Token authorized by this user can be misused by app to modify resources in any of the subscriptions.

Unlike graph (graph.microsoft.com) api where you can handpick the permission (user.read), resource management api has only one option - user\_impersonation! 

You may argue why would a privileged user authorize the action but people make mistakes. Our job is to stop or minimize such risk by design. So, what's the best way to allow app to manage resources in azure and minimize the security risk?