Permissions needed for Service Principal to Update Reply Urls / Redirect Uris

Hello,

I was wondering if somebody could help, I have a service principal/app registration e.g: 12345, I am logging into the cli via:

`az login --service-principal --username 12345 --password ${PASS} --tenant ${TENANT_ID}`

I am able to to get the current reply URLs via this command:
`az ad app show --id 12345 --query replyUrls`

However when I try to update the replyUrls using the az rest command via this command:
` az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$OBJECT_ID" --headers 'Content-Type=application/json' --body "{\"spa\":{\"redirectUris\": "$NEW_REDIRECT_URIS"}}" --debug`

I get the following:
```
0:10:18 DOCKER: Response content:
10:10:18 DOCKER: {
10:10:18 DOCKER: "error": {
10:10:18 DOCKER: "code": "Authorization_RequestDenied",
10:10:18 DOCKER: "message": "Insufficient privileges to complete the operation.",
10:10:18 DOCKER: "innerError": {
10:10:18 DOCKER: "date": "2020-09-09T09:10:18",
10:10:18 DOCKER: "request-id": "7f409de5-dad1-41b5-af84-3023291c32ae"
10:10:18 DOCKER: }
10:10:18 DOCKER: }
10:10:18 DOCKER: }
10:10:18 DOCKER: cli.azure.cli.core.util : Forbidden({
10:10:18 DOCKER: "error": {
10:10:18 DOCKER: "code": "Authorization_RequestDenied",
10:10:18 DOCKER: "message": "Insufficient privileges to complete the operation.",
10:10:18 DOCKER: "innerError": {
10:10:18 DOCKER: "date": "2020-09-09T09:10:18",
10:10:18 DOCKER: "request-id": "7f409de5-dad1-41b5-af84-3023291c32ae"
10:10:18 DOCKER: }
10:10:18 DOCKER: }
10:10:18 DOCKER: })
10:10:18 DOCKER: Forbidden({
10:10:18 DOCKER: "error": {
10:10:18 DOCKER: "code": "Authorization_RequestDenied",
10:10:18 DOCKER: "message": "Insufficient privileges to complete the operation.",
10:10:18 DOCKER: "innerError": {
10:10:18 DOCKER: "date": "2020-09-09T09:10:18",
10:10:18 DOCKER: "request-id": "7f409de5-dad1-41b5-af84-3023291c32ae"
10:10:18 DOCKER: }
10:10:18 DOCKER: }
10:10:18 DOCKER: })
```

My app registration has API permissions for Microsoft Graph -> Application.ReadWrite.OwnedBy, which I thought would be the only permission required...but it seems like it's not. What else do I need to add to allow a service principal to update an app service (itself)?

Thanks and sorry if this question is off-topic, It has been super difficult to find an answer to this.