Hi all,
I've been trying to add OneNote as a tab to all newly created channels within teams. I'm using REST API calls as per tutorial I can no longer find. I've got an app registered in AAD with the following permissions:

I need to use delegated (work account) permissions due to company rules.
I've tried calling the API using two ways of authorization:
AD OAuth in advanced options of the connector like this:

And getting the token separately before and attaching it as header with the request:

(Please ignore the body of the tab for now, it was copied straight from the tutorial - unless it could mess with permissions?)
Both ways I'm getting a 403 error:
Missing role permissions on the request. API requires one of 'TeamsTab.Create, TeamsTab.ReadWriteForTeam.All, TeamsTab.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, TeamsTab.Create.Group'. Roles on the request ''. Resource specific consent grants on the request ''.
Honestly no idea what I'm doing wrong. Something else I need to add to the app registration? Does it not actually work with delegated permissions (even though the documentation says it should)?
I've looked around and could not find anything very relevant so I'll appreciate any help!