OData web service endpoint with OAuth2

In a BC Cloud demo environment, I'm trying to call an OData web service using OAuth2 bearer token. It's working when calling a service based on a standard BC page, but not when calling a service based on a page added in an extension.

I'm able to get the token. Like I said, the OData call works fine if it's for a standard NAV page. I made an entry (named TaxGroupTest) in Web Services for page 467, Tax Groups. I checked Publish so that the web service is active.

Using REST Client in Visual Studio Code, I made a Get request to the OData service:

GET api.businesscentral.dynamics.com/v2.0/385c4a01-a86f-4a0c-8693-############/Sandbox/ODataV4/Company('CRONUS%20USA%2C%20Inc.')/TaxGroupTest HTTP/1.1
Authorization: Bearer {{auth.response.body.$.access_token}}
Content-Type: application/json

It worked. It sent back the list of Tax Group records in BC.

I created an extension for a new page with ID in 50000 range, based off the same table (Tax Group). I made another entry in Web Services for this new page and called the service TaxGroupTest2.

Here is the Get request for this service:

GET api.businesscentral.dynamics.com/v2.0/385c4a01-a86f-4a0c-8693-############/Sandbox/ODataV4/Company('CRONUS%20USA%2C%20Inc.')/TaxGroupTest2 HTTP/1.1
Authorization: Bearer {{auth.response.body.$.access_token}}
Content-Type: application/json

However, this request fails and returns the following error message:
"You do not have access to this object using an application as authentication."

In Azure Active Directory, I gave all permissions that would seem relevant: API.ReadWrite.All, app_access, Automation.ReadWrite.All, Financials.ReadWrite.All. I granted admin consent. In BC, I created an entry in table AAD Application, and added permission sets D365 Automation, Exten. Mgt. - Admin, and Super. So, I'm not sure what else I can do from a permissions standpoint.

Has anybody else experienced this issue? Is this somehow related to licensing issues that Microsoft is still working out? We are working on a new integration and I would prefer not to use Basic Authentication, as it will be deprecated next year.

Thank you