How to generate valid access_token to interact with Business Central - azure

Question

I'm trying to create an automation to interact with Microsoft Business Central. For that I created a Azure App (daemon).
This app has granted permissions from the admin to Read/Write on BC, permissions such as Financials.ReadWrite.All and API.ReadWrite.All and are consented.
When I generate the access token, I can list environment and companies, but cannot list items https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/api-reference/v2.0/api/dynamics_item_get
What other permission do I need?
Here is the error I get when trying to list:
{
"error": {
"code":"Internal_ServerError",
"message":"Sorry, the current permissions prevented the action.(Page APIV2 - Items Execute: _Exclude_APIV2_)"
}
}
If I get the token from here, with my user on it, it works: https://developer.microsoft.com/en-us/graph/graph-explorer

Answer 1

You need to register the Azure App inside Business Central and assign it the required permissions.
You can do this through the Azure Active Directory Applications page.

Answer 2

If you select the app_access permission in you oauth application you also need to give permission inside Business central as Ramon already explained
If you do not assign that permission, and grant consent inside the oauth application already, that app can access all your environments within that tenant