An admin must consent to the permissions. You should make an authorization request to Azure AD that includes the parameter prompt=admin_consent.
As in the documentation here, the prompt parameter can have 3 values: login, consent, or admin_consent.
So, you should go to a URL such as https://login.microsoftonline.com/tenant-id/oauth2/authorize?client_id=app-client-id&redirect_uri=encoded-reply-url&response_type=code&prompt=admin_consent.
Replace tenant-id with your Azure AD tenant id/domain name, or common if your app is multi-tenant. Replace app-client-id with your app's client id. Replace encoded-reply-url with a URL-encoded reply URL of your app.
An easier way of constructing the URL you need is to go through authentication and just grab the URL in the address bar when you hit Azure AD. Then just add &prompt=admin_consent to the URL.
NOTE: With the newest update to the Azure Portal came the ability to grant permissions from the portal directly.
If you go to Azure Active Directory in the new portal, find your app registration there and click Grant Permissions under the Required permissions blade.
![image](https://i.stack.imgur.com/CTI5I.png)