I've seen posts like this one where there is confusion on exactly what permission is required to allow a ServicePrincipal to call Get-AzureRmRoleAssignment when logging in using Login-AzureRmAccount.

In my case if I call Get-AzureRmRoleAssignment with the -debug flag I can capture the following error in the body of the HTTP response:

Body:
{
  "odata.error": {
    "code": "Authorization_RequestDenied",
    "message": {
      "lang": "en",
      "value": "Insufficient privileges to complete the operation."
    }
  }
}

I have set perms for the application as follows... first the Azure AD access:

And then the Microsoft Graph access:

This still gives the authZ failure error. I have even tried an experiment where I gave the app ALL perms for each API, and that still did not work.

What's missing? What perms EXACTLY are needed to allow read only programmatic access to list the role assignments with this call?

First, as I answered in that case, Get-AzureRmRoleAssignmentdoesn't only needs read access for role assignment with Azure REST API permission but also needs Read directory data permission with Azure AD Graph API. After adding permissions,

Add AAD Graph API Permission:

You also need to click Grant permissions button to do admin consent.

Add Azure REST API Persmssions:

Also, before adding AAD graph API permissions for your sp, ensure your sp has permissions with Azure REST API by assigning a role (E.g. A Contributor Role) to it from Subscriptions RBAC(IAM).

I test this and succeeded.