setup permissions custom uses User.Read token for OAuth2 grant operation

Summary

a365 setup permissions custom attempts to create/read oauth2PermissionGrants with a Microsoft Graph token requested for only User.Read. The operation fails with Authorization_RequestDenied even when the signed-in user is a Global Administrator.

Environment

• Agent 365 CLI: 1.1.214+90c444832f
• Windows / PowerShell
• Signed-in user: Global Administrator

Reproduction

a365 setup permissions custom `
  --resource-app-id 90ecec28-f5a6-42b3-9bde-dae1ca98f8b5 `
  --scopes "Computer.See,Computer.Control" `
  --verbose

Actual behavior

The CLI successfully adds the resource to the blueprint's requiredResourceAccess, then fails while reading/creating the OAuth2 permission grant:

OAuth2 permission grant failed ... Authorization_RequestDenied:
Insufficient privileges to complete the operation.

Verbose logging shows the token provider explicitly requests and reuses a Graph token scoped only to User.Read:

Acquiring Graph token via token provider (... scopes: User.Read)
Reusing cached Graph token ... ::User.Read::...
Graph POST /v1.0/oauth2PermissionGrants ... failed 403 Forbidden

The CLI then reports that tenant admin action is required even though the user is a Global Administrator.

Expected behavior

The CLI should acquire a Graph token containing the permission required by the Graph operation—at minimum DelegatedPermissionGrant.ReadWrite.All—or drive the documented admin-consent handoff when its client app lacks that permission.

Microsoft Graph documents DelegatedPermissionGrant.ReadWrite.All as the least-privileged permission for POST /oauth2PermissionGrants:
https://learn.microsoft.com/graph/api/oauth2permissiongrant-post?view=graph-rest-1.0#permissions

Workaround / validation

Using an independently acquired Graph token containing DelegatedPermissionGrant.ReadWrite.All succeeds for the grant operation. The remaining blueprint inheritance entry can also be created directly through the official inheritablePermissions Graph API.

This issue is especially confusing because the user's directory role is sufficient, but both the directory role and the client token's Graph scopes are required.