Getting 403 for /v1.0/identityGovernance/entitlementManagement/catalogs/{catalog-id} with delegated auth via Azure CLI

I am authenticating to Microsoft Graph via a delegated access token for my user account, issued for Azure CLI (appID 04b07795-8ddb-461a-bbee-02f9e1bf7b46). My user is assigned the Global Admin directory role with root tenant scope, and the access token issued for az-cli includes the Directory.AccessAsUser.All scope.

When requesting GET /v1.0/identityGovernance/entitlementManagement/catalogs/00000000-0000-0000-0000-000000000000, I get the following 403 error:

HTTP/1.1 403 Forbidden
Transfer-Encoding: chunked
Content-Type: application/json
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 0669f944-f34f-4345-aac3-81b0e3478565
client-request-id: 0669f944-f34f-4345-aac3-81b0e3478565
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"003","RoleInstance":"LO2PEPF00000037"}}
Date: Mon, 17 Apr 2023 18:21:18 GMT

{
  "error": {
    "code": "UnAuthorized",
    "message": "User is not authorized to perform the operation. Reason: The caller is not authorized.",
    "innerError": {
      "date": "2023-04-17T18:21:44",
      "request-id": "d5d7cd97-c984-4730-8b66-fd96c1524fca",
      "client-request-id": "d5d7cd97-c984-4730-8b66-fd96c1524fca"
    }
  }
}

The same also happens when I request GET /beta/identityGovernance/entitlementManagement/accessPackageCatalogs/00000000-0000-0000-0000-000000000000.

All requests are being made to MS Graph Global at https://graph.microsoft.com.

Start with the reported /v1.0/identityGovernance/entitlementManagement/catalogs and /beta/.../accessPackageCatalogs endpoints, then review the delegated token scopes and required Microsoft Graph permissions for those entry points. Done means establishing whether the 403 is expected authorization behavior or a metadata/API issue and documenting the verified requirement; no repository files or tests are named.