This is sometimes an Admin Consent issue. The 'permissions' in App Registration aren't really permissions, they're permissions the app requires.

In Entra Enterprise Apps you'll find an 'admin consent' button which can give admin level data.