How can I update a Planner task's isOnMyDay property using MS Graph without a 403 error?

I'm trying to update the isOnMyDay property for my Planner tasks using MS Graph because MS MyDay clears everything at midnight. Initially, I prototyped the update using Graph Explorer with the beta API, which accepts an If-Match header containing the task's ETag and works as expected when I manually supply the values. The plan was simple:

• Request a list of all tasks
• Determine which tasks should be on MyDay
• Toggle the isOnMyDay property using the beta endpoint (since v1.0 doesn’t support this update).

I then moved this logic into an app. I registered the app with the Tasks.ReadWrite.All permission and consented as admin. After resolving the header formatting issues, my app call still returns a 403 error with the message "You do not have the required permissions to access this item, or the item may not exist."

When I copy the same id, ETag, and data from the failing request into Graph Explorer, it works fine. Below is the relevant request snippet:

JSONCopied
{
   '_headers' => bless( {
     'user-agent' => 'libwww-perl/6.77',
     'if-match' => 'W/"<some identifier>"',
     'accept' => '*/*',
     'consistencylevel' => '',
     '::std_case' => {
         'consistencylevel' => 'Consistencylevel'
     },
     'content-type' => 'application/json; charset=utf-8 ',
     'authorization' => 'Bearer <some key>'
     }

And the data payload:

JSONCopied
'_content' => '{"isOnMyDay":true}'

The response from the API is:

JSONCopied
{
    "error": {
        "code": "",
        "message": "You do not have the required permissions to access this item, or the item may not exist.",
        "innerError": {
            "date": "2025-02-07T10:43:17",
            "request-id": "<some id>",
            "client-request-id": "<some id>"
        }
    }
}

The task id and ETag are extracted from a prior list query. I also provided a snippet from the authentication routine as requested by Rukmini:

PERLCopied
sub  getToken {
    my $self = shift;
    #say "Token ophalen";
    my $url = $self->_get_login_endpoint."/".$self->_get_tenant_id."/oauth2/token";
    my $ua = LWP::UserAgent->new(
        'send_te' => '0',
    );
    my $r = HTTP::Request->new(
        POST => $url,
        [
            'Accept'        =>  '*/*',
            'User-Agent'    =>  'Perl LWP',
            'Content-Type'  =>  'application/x-www-form-urlencoded'
        ],
        "grant_type=client_credentials&".
        "client_id="     .$self->_get_app_id . 
        "&client_secret=". $self->_get_app_secret . 
        "&scope="        . $self->_get_graph_endpoint . "/.default" .
        #"&scope="        .  "offline_access" . # Dit zou een refresh token op moeten leveren in de reply maar werkt niet
        "&resource="     . $self->_get_graph_endpoint,
    );

    my $result = $ua->request($r);

    if ($result->is_success){
        my $reply = decode_json($result->decoded_content);
        #print Dumper $reply;
        $self->_set_access_token($reply->{'access_token'});
        $self->_set_token_expires($reply->{'expires_on'});
    }else{
        print Dumper $result;
        die $result->status_line;
    }
}

I also attached a screenshot of the app permissions showing Group.ReadWrite.All as per Rukmini’s suggestion, though I don’t think it affects this issue. My main question is: What permissions or changes do I need to successfully update the isOnMyDay property for my tasks using MS Graph?

Any insights or suggestions are appreciated.