Resource server
A resource server hosts protected data or operations and processes access requests made with access tokens.
The API receiving the token
When an app requests directory information from Microsoft Graph, Graph fills the resource-server role. Microsoft Entra ID issues the token; Graph receives it with the API request and checks whether the requested operation is allowed.
Those are separate decisions. An app can obtain a token and still lack permission to read particular data. For delegated access to Graph, both the application’s permissions and the signed-in user’s access matter.
When investigating a failed request, identify the destination API as well as the OAuth client. “The app signed in successfully” does not explain why that API refused access. Check the permissions required by the actual operation rather than assuming every request using that token should work.