...
On the search bar, search for App registrations. Select the App registration that you have created
Click API permissions and Add a permission
Select "Microsoft Graph"
Select "Application permissions"
Select and add User and check "User.Read.All", (recommended option)
If you only select lower permission “User.ReadBasic.All” user atributes will not be fully imported
Select following API permissions:
"Group.Read.All"
"Device.ReadWrite.All"
"DeviceManagementManagedDevices.Read.All"
"Application.ReadWrite.All"or least privilege “GroupMember.Read.All“
...
Click "Grant admin consent for “your specific subscription”.
...