We get the 403 forbidden error when changing passwords via an application

Question

We use OpenText (formerly NetIQ) Identity Manager to create and maintain users on AzureAD/Entra, using the OpenText AzureAD Driver. It all works fine except for passwords; we get the 403 Forbidden error when we change a password and the driver stops. We have set many MS Graph API permissions on the registered application including Directory.ReadWrite.All (delegated and application) and Directory.AccessAsUser.All (delegated). The user we connect to AzureAD with is a Global Adminstrator, authentication administrator, user administrator, which is probably overkill. Is there an alternative permission that we need? This is an example of an admin user needing to reset the permission of other users. I am not that familiar with AzureAD so please keep the advice simple.