Question about the new app linking IAM/subscription/resources on Azure portal

Question

I am new to the Azure Cloud. My goal is to create a on-boarding documentation for our company users to access their Azure storage accounts via Federated credentials (OIDC) after setting up the trust relationship between Azure and our issuer.

I was able to do just that ( new App | Certificate and creentials | Federated credentials, Add a credential, configure everything before save ). The az login works now.

The app has its own client ID and I am not sure how to link that with our azure storage account or share the storage account with this azure app that the users now have access to.

I think my questions include:

1. How do I link / assign the azure storage account resource to a new app I just created for federated credential (OIDC) access?
2. When I log into azure using the access token generated from the JWT via OIDC, I have to have the "--allow-no-subscription" option specified. How do I assign an existing subscription to the app's client ID?

Not looking for detailed instructions but some summary to point me to the specific section in the az documentation. Any inputs are greatly appreciated.