...
Log into your Microsoft Azure account using an administrator account.
Select Azure Active Directory.
Select Add and select App registration.
Enter a name for the app in the Name field.
Under Supported account types, select Accounts in this organizational directory only ([company name] only- Single tenant).
Select Register.
Under Mange , select Authentication.
Set the Enable the following mobile and desktop flows option at the bottom of the page to Yes.
Select Save at the top of the page.
Under Manage, select API Permissions.
Select Add a permission.
In the Request API Permissions panel, select Azure Rights Management Services.
Select the Delegated permissions option.
Select the user_impersonation box.
Select Add permissions.
You will be back on the API Permissions Page. Select Add a permission again.
Select APIs my organization uses.
In the search box, type “Microsoft Information Protection Sync Service” and select this option in the results list.
Select Delegated permissions.
Select the UnifiedPolicy.User.Read box.
Select Add permissions.
Select Grant admin consent for [company name]."
Select Yes when prompted to confirm you want to grant admin consent.
Select Overview.
Copy the Application (client) ID and the Directory (tenant) ID. Both are needed for the extension configuration.
...