Laura Kokkarinen in the article How to setup SharePoint Online Sites.Selected permissions — Step by step (published February 14, 2026):

The process of granting these permissions is two-fold:

Grant the Sites.Selected permission for your Azure app’s managed identity to the SharePoint Online API as you normally would.
Add the permission your app needs on a specific site via the Microsoft Graph API to the site entity.

Good link to have on hand.