Getting "Authorization has been denied for this request." when attempting to create a channel in Teams - azure-ad-graph-api

Question

I am getting this rather unhelpful error and it seems to occur for a large variety of things based on the SO posts. So here I am.
I went here https://apps.dev.microsoft.com, logged in and created a new App. I generated a secret and stored it for later on a post-it note... I granted "Group.ReadWrite.All" under "Delegate" as the create channel API doc says I should. I left everything else in the App as default.
I then do a token request like so:
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" \
"https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token" \
-d "client_id=$APP_ID" -d "scope=https%3A%2F%2Fgraph.microsoft.com%2F.default" \
-d "client_secret=$PASSWORD" -d "grant_type=client_credentials"
which gives me this mess:
{"token_type":"Bearer","expires_in":3600,"ext_expires_in":0,"access_token":"BIG_LONG_TOKEN"}
I then take that token and stuff it into my Authorization header and make the call to create the channel:
curl "https://graph.microsoft.com/beta/groups/$TENANT/channels" \
-H "Content-type: application/json" \
-H "Authorization: Bearer $BIG_LONG_TOKEN" \
-d '{
"displayName": "mynewchannel",
"description": "Channel Description"
}'
But this results in tears and this:
{
"error": {
"code": "",
"message": "Authorization has been denied for this request.",
"innerError": {
"request-id": "c572f6df-7537-4a53-aefc-fcc8c71e2037",
"date": "2018-04-17T23:46:50"
}
}
}
I am not sure what I'm missing, but hopefully it's obvious to someone else...
EDIT: Interestingly, if I set TOKEN to garbage, I get a more helpful answer, but this indicates my TOKEN is at least mostly ok and it is more of a authorization rather than an authentication issue
TOKEN=garbage
curl -X GET "https://graph.microsoft.com/beta/groups/$TENANT/channels" -H "Content-type: application/json" -H "Authorization: Bearer $TOKEN"
Results in
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "CompactToken parsing failed with error code: 80049217",
"innerError": {
"request-id": "166cb22b-c135-45e9-9f23-0e73bc68475d",
"date": "2018-04-18T00:20:47"
}
}
}

Answer 1

I went here https://apps.dev.microsoft.com, logged in and created a new App. I generated a secret and stored it for later on a post-it note...
According to Create Channel Rest API document, Application type permission is not supported. So you get the error information Authorization has been denied for this request.
Delegated permissions are used by apps that have a signed-in user present. For these apps either the user or an administrator consents to the permissions that the app requests and the app is delegated permission to act as the signed-in user when making calls to Microsoft Graph. Some delegated permissions can be consented to by non-administrative users, but some higher-privileged permissions require administrator consent.
As Wajeed - MSFT mentioned that you could use Graph explorer with your account login to have a try.
Note: APIs under the /beta version in Microsoft Graph are in preview and are subject to change. Use of these APIs in production applications is not supported.