Turns out that what I needed was to add the API Permission of the App Registration to Application.ReadWrite.All and have my Entra admin apply Global Consent
Application.ReadWrite.All