This is a bit tricky. For me, I had to ensure that the app registration for which I was generating the token via az cli - Get-AzAccessToken -ResourceUrl "api://$CLIENT_ID" - included in the list of authorized apps - under "Expose an API" - included the first-party app "Microsoft Azure PowerShell" by id - specifically 1950a258-227b-4e31-a9cf-717495945fc2. See this link to get a list of all such first party apps.