You get a token for MS Graph instead of Azure AD Graph, and a 401 unauthorized error is reported when you use that token to call the Azure AD Graph API. The Azure AD Graph API is currently deprecated and will be retired in the near future. As part of this deprecation path, adding Azure AD Graph permissions to an app registration through the Azure portal is now disabled. I recommend that you use the MS Graph API to list tenant users:
GET https://graph.microsoft.com/v1.0/users
However, your app might still temporarily require Azure AD Graph permissions to access resources. This article describes the following four methods for configuring required Azure AD Graph permissions for your app registration.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.