You need a Microsoft Entra app registration in your own tenant. Open the Azure Portal and create a single-tenant app (no redirect URI is needed — we use the client-credentials flow).
Grant the application permission Sites.ReadWrite.All (read + write across site collections), then click Grant admin consent. For least privilege you can instead grant Sites.Selected and scope this app to just the target site — either works, but Sites.Selected requires an extra per-site grant in Azure.
Finally, create a client secret and paste its value below. We seal it with KMS and never log or echo it back.