Initially, I created one certificate same as you and uploaded it to app registration as below:

To add Directory.Read.All permission of Application type and Reader role to service principal at root level, make use of below updated script:

$applicationName = "SriCertApp"

$spId = (Get-AzADServicePrincipal -DisplayName $applicationName).Id

# Assign Reader role to the Service Principal under specific subscription
New-AzRoleAssignment -ObjectId $spId `
    -RoleDefinitionName "Reader" `
    -Scope "/"

Write-Host "Reader role assigned to Service Principal."

# Get the Azure AD Application by AppId
$app = Get-AzADApplication -ApplicationId $sp.AppId
$appObjectId = $app.Id

# Add Microsoft Graph Directory.Read.All permission of Application type
Add-AzADAppPermission -ObjectId $appObjectId `
    -ApiId "00000003-0000-0000-c000-000000000000" `
    -PermissionId "7ab1d382-f21e-4acd-a863-ba3e13f7da61" `
    -Type Role

Write-Host "Microsoft Graph Directory.Read.All permission granted."

Response:

To confirm that, you can check the same in Azure Portal where role and permission assigned successfully like this:

Reader role:

Directory.Read.All permission

Make sure to grant admin consent to above permission that allows service principal to read directory data:

Now, make use of below script to fetch all VMs across all subscriptions connecting with certificate authentication:

$appId = "appId"
$tenantId = "tenantId"
$thumbprint = "cert_thumbprint"

Connect-AzAccount -ApplicationId $appId -Tenant $tenantId -CertificateThumbprint $thumbprint

$subscriptions = Get-AzSubscription
$allVms = @()

foreach ($subscription in $subscriptions) {
    Set-AzContext -SubscriptionId $subscription.Id
    $vms = Get-AzVM

    foreach ($vm in $vms) {
        $vmDetails = [PSCustomObject]@{
            VMName = $vm.Name
            SubscriptionName = $subscription.Name
            ResourceGroupName = $vm.ResourceGroupName
        }
        $allVms += $vmDetails
    }
}

$allVms | Format-Table -AutoSize
$allVms | Export-Csv -Path "C:testvms.csv" -NoTypeInformation

Response:

To pull down the global admins in the Microsoft Entra tenant with certificate authentication, make use of below Microsoft Graph script:

$appId = "appId"
$tenantId = "tenantId"
$thumbprint = "thumbprint"
$roleName = "Global Administrator"

Connect-MgGraph -ClientId $appId -TenantId $tenantId -CertificateThumbprint $thumbprint

$adminRole = Get-MgDirectoryRole -Filter "DisplayName eq '$roleName'"

if ($adminRole) {
    $roleMembers = Get-MgDirectoryRoleMember -DirectoryRoleId $adminRole.Id

    if ($roleMembers) {
        $roleMembers | ForEach-Object {
            [PSCustomObject]@{
                DisplayName = $_.AdditionalProperties["displayName"]
                Id          = $_.Id
            }
        } | Format-Table DisplayName, Id
    } else {
        Write-Host "No members found for the role: $roleName"
    }
} else {
    Write-Host "Role '$roleName' not found"
}

Response: