Listing business central companies results in 401 unathorized

Question

I am attempting a Graph api call as described here:
https://learn.microsoft.com/en-us/graph/api/dynamics-companies-get?view=graph-rest-beta

I have retrieved a valid access token. To test the token validity, I can successfully list groups from '/beta/groups/'. The user associated with the access token, can log into Business Central.

Viewing the access token through jwt.ms shows that:

• The access token has not expired.
• Permissions include 'Financials.ReadWrite.All'. Full set: Financials.ReadWrite.All Group.ReadWrite.All User.Read profile openid email

The raw HTTP request looks like this:

GET /beta/financials/companies HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer ...

(With no body)

The response is 401 Unauthorized, with JSON body:

{"error":{"code":"Authentication_InvalidCredentials","message":"The server has rejected the client credentials. CorrelationId: 1c60c7bc-8b89-4a14-bc6e-3926cde7b261.","innerError":{"date":"2021-05-26T09:46:29","request-id":"0751c960-828b-4887-bac2-ceed122aeebb","client-request-id":"0751c960-828b-4887-bac2-ceed122aeebb"}}}

I have tried calling the API through Postman, Javascript and PHP (Microsoft Graph SDK for PHP) and Graph Explorer. They all return 401. The error code and message is identical to calling the Dynamics 365 Business Central API (api.businesscentral.dynamics.com/...), with invalid credentials.

What am I missing?