@CLee47 , I would imagine that the portal is not at the correct subscription level meaning that even if they are a superadmin, they still would not have access to all necessary scopes
Thanks for the suggestion - they are using a starter plan. I tried removing the reports scope, so now we are using content, business-intelligence, oauth
These are such basic scopes that encompass basically the entire API - it's very hard to believe that they don't have access based on the plan.