I'm trying to use the Azure DevOps Member Entitlement Management REST API to get a user by ID using the .NET Client.

I've set up a Personal Access Token (PAT) which includes Member Entitlement Management (Read) and Entitlements (Read), among other scopes.

When I call the Search endpoint I get a list of UserEntitlement, but the GET endpoint throws the exception:

Access Denied: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx needs the following permission(s) on the resource Users to perform this action: ReadExtended Users

I don't know what this means... how do I add "ReadExtended Users" to the Users resource? I've looked through PAT scopes and user permissions and I can't find it.

Any why is it that I can list ALL users, but not get a single user by ID?? The documentation implies that the same permissions are required for both, and the returned objects are the same type (UserEntitlement).

Here's some code:

var uri = new Uri("https://vssps.dev.azure.com/MY_ORGANIZATION");
var credentials = new VssBasicCredential("", "PAT");
using (var connection = new VssConnection(uri, credentials))
using (var client = connection.GetClient<MemberEntitlementManagementHttpClient>())
{
  return client.GetUserEntitlementAsync(new Guid("USER_ID")).Result;
}

I'm using v15.131.1 of the client API, .NET Fx 4.5.2. Yes, it a bit outdated but it's based on the Quickstart samples and the target project is .NET Fx.