Attempt to get list of Workspaces via REST API results in 401 Unauthorized.

I finally found the answer to this issue and wanted to document it here.

The issue is that you don't need to just add API Permissions to an App Registration. You need to also consent to each API Permission (scope) at a user or app level. Now, an admin can grant access for all users (which is what is mentioned by some answers here in this post), but I'm not an admin, so I couldn't do that. What I needed to do was consent as a user to the specific API permissions that I had added to my App Registration.

Unfortunately, I couldn't find a way to do this in the Azure AD interface. In fact, I only found one place anywhere that actually explained how to do this for a *user* (the admin-level consent was mentioned in numerous places). Here is an answer here which talks about the URL needed to grant user consent to an API permission: https://stackoverflow.com/questions/59282141/aadsts65001-the-user-or-administrator-has-not-consented-to-use-the-application

The URLs look like so: 

https://login.microsoftonline.com/[Put your Tenant ID here]/oauth2/v2.0/authorize?
client_id=[This is your Client ID from your App Registration]
&response_type=code
&redirect_uri=https://myapp.mycompany.com[This must be the Redirect URI you setup in your App Registration]
&response_mode=query
&scope=https://graph.microsoft.com/User.Read[This is the scope URL for the API Permission]

Once I (finally) found that example, I was able to piece together a URL to consent to the newly added Workspace API permissions and my code started working. You can find out the "scope" URL for each API permission (which you have to add to the end of the full URL above) by going to your App Registration and clicking on API Permissions and then clicking on any of the API permissions you've added. This will bring up a window which shows the URL for that API Permission.