Microsoft Graph get user photos - vba

Question

I try to download the profile picture from some users in my organization. I'm getting the access_token, but in the next step get the error message:
The token contains no permissions, or permissions can not be
understood.
My app has in my point of view all required permissions:
2
Here is my used code:
Sub Test_GetToken()
Dim xml As New MSXML2.XMLHTTP60
Dim url As String
Dim Json As Object
url = "https://login.microsoftonline.com/tenant_id/oauth2/v2.0/token"
xml.Open "POST", url, False
xml.setRequestHeader "application", "x-www-form-urlencoded"
xml.Send ("client_id=1234678&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&client_secret=12345678&grant_type=client_credentials")
Set Json = JsonConverter.ParseJson(xml.responseText)
access_token = Json("access_token")
token_type = Json("token_type")
expires_in = Json("expires_in")
ext_expires_in = Json("ext_expires_in")
' trying to get the photo
url = "https://graph.microsoft.com/v1.0/users/user1#OUTLOOK.DE/photo/$value"
xml.Open "GET", url, False
xml.setRequestHeader "application", "x-www-form-urlencoded"
xml.setRequestHeader "Content-Type", "text/json"
xml.setRequestHeader "Authorization", token_type & " " & access_token
xml.Send ("")
'Debug.Print token_type & " " & access_token
'Debug.Print xml.getAllResponseHeaders
Debug.Print xml.responseText
Set xml = Nothing
End Sub
Does anybody has an ideas where the mistake is?

Answer 1

There are several things wrong here:
There isn't an application header in HTTP
x-www-form-urlencoded is an incomplete Content-Type (it should be `application/x-www-form-urlencoded).
Your Content-Type should be application/json
You cannot use the Client Credentials OAuth grant to access a Microsoft Account (i.e. a personal #Outlook address). Client Credentials can only access data from users within your tenant. In order to access personal account data, you need to have the user authenticate using either the Authorization Code or Implicit OAuth grants.

Answer 2

I got Admin Consent and now it works. thanks to Marc for improving my code and getting the solution.