Microsoft security is a bimodal. They might have exquisite delineation for network resources in Sharepoint or Azure but consumer applications are a joke.

Excel, VSCode, Outlook, etc the permission model is a modal, "Do you trust this?" binary choice to enable full permissions to everything.

Seriously. Mobile devices have done a better job with this (in some ways) but it really should be a standardised thing of least permissions by default. And way. Way less confusing.