I want to list current service health events in the tenant via https://learn.microsoft.com/en-us/rest/api/resourcehealth/events/list-by-tenant-id?view=rest-resourcehealth-2024-02-01&tabs=HTTP.

I created a service principle with a secret and can successfully query e.g. for those events on subscription level via https://learn.microsoft.com/en-us/rest/api/resourcehealth/events/list-by-subscription-id?view=rest-resourcehealth-2024-02-01&tabs=HTTP

I gave the service principle Reader permissions on Tenant Root Management Group level but get the error:

The client ‘xxx’ with object id
‘xxx’ does not have authorization to
perform action ‘Microsoft.ResourceHealth/events/read’ over scope
‘/providers/Microsoft.ResourceHealth’ or the scope is invalid. If
access was recently granted, please refresh your credentials.

The scope for the token request is

https://management.azure.com/

What do I need to do to successfully run the request on tenant level?