I have created an Azure App registration, and granted it permissions to manage SharePoint sites. then i want to query the SharePoint sites' users, using SharePoint API, here the first request to get the access_token

then i get the access token and pass it inside the Authorization header, as follow:-

but the second action return Unauthorized:-

{
    "statusCode": 401,
    "headers": {
        "Cache-Control": "private",
        "Server": "Microsoft-IIS/10.0",
        "X-NetworkStatistics": "0,4194720,0,0,39,24479,24479,15301",
        "IsOCDI": "0",
        "X-DataBoundary": "EU",
        "X-1DSCollectorUrl": "https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/",
        "X-AriaCollectorURL": "https://eu-mobile.events.data.microsoft.com/Collector/3.0/",
        "SPRequestGuid": "c20dd9a1-7025-e000-6f5b-0d2e1e2d49d1",
        "request-id": "c20dd9a1-7025-e000-6f5b-0d2e1e2d49d1",
        "MS-CV": "odkNwiVwAOBvWw0uHi1J0Q.0",
        "SPLogId": "c20dd9a1-7025-e000-6f5b-0d2e1e2d49d1",
        "Alt-Svc": "h3=\":443\"",
        "Strict-Transport-Security": "max-age=31536000",
        "X-Frame-Options": "SAMEORIGIN",
        "Content-Security-Policy": "frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com m365.cloud.microsoft *.cloud.microsoft *.stream.azure-test.net *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;",
        "SPRequestDuration": "23",
        "SPIisLatency": "1",
        "x-ms-suspended-features": "features=\"\"",
        "X-Powered-By": "ASP.NET",
        "MicrosoftSharePointTeamServices": "16.0.0.26629",
        "X-Content-Type-Options": "nosniff",
        "X-MS-InvokeApp": "1; RequireReadOnly",
        "P3P": "CP=\"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\"",
        "WWW-Authenticate": "Bearer realm=\"0bcccd25-af10-4583-95d7-53f14b7a506e\",client_id=\"00000003-0000-0ff1-ce00-000000000000\",trusted_issuers=\"00000001-0000-0000-c000-000000000000@*,D3776938-3DBA-481F-A652-4BEDFCAB7CD8@*,https://sts.windows.net/*/,https://login.microsoftonline.com/*/v2.0,00000003-0000-0ff1-ce00-000000000000@90140122-8516-11e1-8eff-49304924019b\",authorization_uri=\"https://login.microsoftonline.com/common/oauth2/authorize\"",
        "Date": "Thu, 13 Nov 2025 19:26:48 GMT",
        "Content-Length": "27"
    },
    "body": {
        "$content-type": "application/octet-stream",
        "$content": "VW5zdXBwb3J0ZWQgYXBwIG9ubHkgdG9rZW4u"
    }
}

any advice?