For Microsoft 365 customers. The steps for adding Notate to Microsoft Entra ID (Azure) by hand, and the full list of permissions to grant, are in the Administrator's Guide:
Prerequisites and Microsoft Entra ID permissions: see "Manual configuration (optional)" and "Required permissions".
Most organizations don't need the manual steps: an administrator can simply sign in to Notate once and accept the permissions request. See Why do I get the error "Need admin approval" when starting Notate?