postman – Get tenant wide access token for REST api calls

Testing REST calls in Postman, I registered an app in my tenant root site, got an access token but a call to get, for example, page content in a different /sites/ site collection fails with an access denied error. My question is does an access token granted for an app registered in the root site work with all sites in the tenant? Or do I need to register an app for each site collection?
Do I need to change the permissions xml and use http://sharepoint/content/tenant in the scope?

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read" />
</AppPermissionRequests>