This tool signs in as you using Microsoft's own login. To do that, Azure needs to know this app exists. You only do this once — takes about 3 minutes in the Azure Portal.
1. Go to portal.azure.com → App registrations
2. Click New registration
3. Name: cyberadvisers-provisioner
4. Supported account types: Accounts in this organizational directory only
5. Redirect URI → select Single-page application (SPA)
Enter: http://localhost (update once you know your SharePoint URL)
6. Click Register
7. Copy the Application (client) ID and Directory (tenant) ID from the Overview page
8. Go to API permissions → Add a permission → Azure Service Management → user_impersonation
9. Click Grant admin consent