Add delegated permissions step

scripts/create-pcs.sh

@@ -114,6 +114,16 @@ EOF
             web.implicitGrantSettings.enableIdTokenIssuance=true \
       1>/dev/null
 
+    # Ensure service principal exists before granting tenant-wide admin consent.
+    az ad sp create --id "$APP_ID" 1>/dev/null 2>/dev/null || true
+
+    # Grant admin consent for configured delegated permissions.
+    az ad app permission admin-consent --id "$APP_ID" 1>/dev/null
+    if [[ $? -ne 0 ]]; then
+      echo "Error: Failed to grant admin consent for '$APP_NAME' ($APP_ID)."
+      exit 1
+    fi
+
     echo "Created application '$APP_NAME'"
     echo "appId: $APP_ID"
 }