Your company develops a web API named FinanceAPI that is registered in Microsoft Entra ID. A separate single-page application (SPA), also registered in the same tenant, must call FinanceAPI on behalf of the signed-in user. You need to allow the SPA to request a delegated permission to FinanceAPI so that users are prompted to consent when they sign in. What must you configure first on the FinanceAPI app registration?