Update December 2024: My team ran into this same issue today seeking to batch update businessPhones field for our users with new DID numbers. We're also working to build a custom API integration between our VOIP provider's API to automatically update Entra records when a phone number and extension is assigned (why they don't offer this basic feature as standard is frustrating.)
After an insane amount of hair pulling, we finally got this working. What we found is bewildering and frustrating as hell: We discovered that there's an undocumented read permission dependency in Microsoft Entra for this Graph API endpoint
We didn't bother to narrow down which one in particular, but we discovered this by creating a custom role in Entra with permission for any update anything user related. That was unsuccessful but out of an act of hands-up-in-the-air-WTF level frustration we created one for read or update for anything "user" related and it started working.
TL/DR: Create an Entra Role that can update and read anything user related and assign that user account the role.