Access to OData is disabled or most errors when using the connector

Question

when using a Power Automate flow to Get Emails from a shared mailbox, with permissions assigned at a mailbox folder level ('FolderVisible' on Root then 'Editor' on Inbox) we can see the mails just fine.

but as soon as a Search Query is added we start getting: You are not authorized to perform this operation. This error can occur for sandbox (test) accounts or if OData operations are disabled by your Exchange server administrator.

note: i know this is documented everywhere as an EWS application access policy restriction but that is not in place in this use case. also that doesn't explain why it works when we assign FullAccess to the mailbox with Add-MailboxPermission.

is this failure because it needs access to the AllItems folder within the mailbox which we just cannot permission directly with Add-MailboxFolderPermission? or something else entirely?