Calling MS Graph Reporting methods via postman - oauth-2.0

Question

Problem Description
I was trying to call this GET via Graph Explorer
https://graph.microsoft.com/v1.0/reports/microsoft.graph.getM365AppUserCounts(period='D7')
But it fails the following error:
The response content is not available in Graph Explorer due to CORS policy. You can execute this request in an API client, like Postman. Read more about CORS and understand how it works here.
What I've Tried so Far
So I went ahead and tried to set up a new application registration in Azure Portal, with a client secret. I've tried both Id Tokens and Access Tokens but I get the same results.
As far as API permissions, I'm not sure what I'm supposed to add to access the reports about M365 application usage. In my case I want to find out the forms usage.
I then forked the MS Graph collection into my local postman workspace and have the following values in the Authorization tab for the collection :
Access Token URL: https://login.microsoft.com/<tenantID>/oauth2/token
Client ID: (new app registration id)
Client Secret: (new secret)
It seems to generate a token no problem. I created a custom query under the MS graph collection and the authorization is set to inherit from parent. And when I check the headers tab, I can see it's using an Authorization header with the token.
But I consistently get the following error message in postman:
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "Access token validation failure. Invalid audience.",
"innerError": {
"date": "2022-10-26T19:52:48",
"request-id": "ggg-3d7b-ggg-a748-ggg",
"client-request-id": "sdfg-3d7b-47d9-a748-sdfg"
}
}
}
Specific questions
What API permissions are needed to run those reports?
any idea on why I'm getting the invalid token error? Is it because I am missing scope?
If i need scope what value do i supply?
Any help would be appreciated.
EDIT 1
I've updated the scope value in Postman to use:
https://graph.microsoft.com/.default
I've updated my Azure Application Registration to move all API permissions except "Reports.Read.All - Application"
In the specific Postman request, under the authorization tab, the value is set to "inherit from parent". Under "Headers" tab, I can see it adds the "Authorization" header with the value of my token. When I click on the "Go to authorization" hyperlink from the headers page, it takes me to the correct Authorization configuration section in the top level folder of the mS Graph collection.
After making these changes, I'm still getting the same error message "message": "Access token validation failure. Invalid audience.","