I noticed that you are requesting the token of your custom api. Obviously, the token of the custom api cannot call MS graph api, so you only need to change the scope
to: https://graph.microsoft.com/.default
.
By the way, when you use application permissions, your administrator must create application access policy and grant users, please pay attention to the description of the document.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.