Putting error and solution here.
Issue:
When connecting S2S Oauth using Postman to BC you get this error in Postman:
More symptoms (OnPrem): In the Application log on the BC Server you get two warnings:
First this one:
Message: User signed in with the following information: user type=Normal user, entitlement set Ids=, authorization status=Failed, guest user=False, failure reason=A user successfully authenticated in Azure Active Directory but the user does not have any entitlements in Business Central.
Then this one:
MessageWithoutPrivateInformation: Your account has been authenticated with Azure Active Directory, but there is no valid license assigned to your account in Business Central. Contact your system administrator to get a valid license assigned to you.
Solution (At least in my case this was the solution):
In Postman under Advanced Options, set Resource = https://api.businesscentral.dynamics.com/
Additional info:
Note that after specifying Resource as show above, this section gets added to the token (decoded in https://jwt.ms/):
"roles": [ "Automation.ReadWrite.All",
"app_access",
"API.ReadWrite.All" ]