Hi @Youngjoo Yang ,
I've updated the tags on your question to get more visibility. By no means am I an expert on Graph but to answer your question, you should be able to access a user's contacts.
Since using the userPrincipalName
in the Graph Explorer was successful, have you tried using actual user's id to see if that works. If that's not successful, then it's either the delegate permissions of your app registration or scope
variable used to generate the token. Verify in jwt.io that the token has the appropriate scopes.