First you'll need to provision an app registration in Microsoft entra ID, then assign permissions.
Choose a single tenant app,
Permissions: