After a lot of trial and error, I managed to get this working.
For me, it was because I hadn't created the correct role assignment. It's also non-obvious how to do it.
Steps that fixed it for me:
- Create the app registration in the portal (Microsoft Entra ID > App registrations > New registration) if not already done.
- Copy the name of the app. You'll need it later!
- Still in the portal, go to the Video Indexer resource that you created.
- Go to Access control (IAM) > Role assignments > Add > Add role assignment.
- Select Privileged administrator roles > Contributor.
- Under Members, select "User, group, or service principal", then click Select members.
- Here's the important bit: A right-hand pane appears with a list of users, but it doesn't include your app name. However, if you search for your app name, it appears. Click it, then click Select.
- Click Review + assign.
You've now set up the correct role assignment for your app and the video indexer resource.
Once I'd done that, I could successfully generate the video indexer access token using the app's bearer token.