externalconnection.readwrite.ownedby-patch.sh

# get token separately or copy from Graph Explorer
read token
# token should have ExternalConnection.ReadWrite.All in scope
# authorized app id should be the app with ExternalItem.ReadWrite.OwnedBy
curl -X PATCH --location 'https://graph.microsoft.com/v1.0/external/connections/<YOUR-CONNECTION>' \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer $token" \
--data '{"id": "<YOUR-CONNECTION>", "configuration": {"authorizedAppIds": ["D49F988A-8F92-46C1-922F-42B209B40042"]}}'

externalitem.readwrite.ownedby-create.sh

read token
conn="<your-connection-id>" #e.g. knowledgebase
name="<Your Readable Connection Name>"
descr="<Your connection description>"
app1="<GUID>" # your current app with ExternalConnection.ReadWrite.All (for further config)
app2="<GUID>" # your second restricted app with ExternalItem.ReadWrite.OwnedBy

curl --location 'https://graph.microsoft.com/v1.0/external/connections' \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer $token" \
    --data '{"id": "'$conn'","name": "'$name'","description": "'$descr'", "configuration": {"authorizedAppIds": ["'$app1'","'$app2'"]}}'