The request body must contain the following parameter: 'client_secret or client_assertion'
What type is the AAD registered Application in your case? If the clientId is from a "Server-side Web app", then specify an extra option -clientsercet. Otherwise register a "Native app" and use the clientid alone.