Which two application permissions are required to be set in Azure AD to integrate Identity Services in Workspace ONE UEM?

Which two application permissions are required to be set in Azure AD to integrate Identity Services in Workspace ONE UEM? (Choose two.)
A. Request certificates on behalf of the user
B. Read and write directory data
C. Register devices
D. Issue Certificates
E. Read and write devices