The appRoleAssignment resource cannot be queried across the entire tenant. It needs to be scoped to a parent resource, either a user, a servicePrincipal, or a group.
Thinking outside the box, you might be able to compile a collection without as much overhead as you're expected. To do this, you'd need to store it outside the AD and periodically refresh the data set.
If you're generally primarily concerned with the user assignments, you could try using /delta queries against user resource list. This would let you only retrieve user resources that have been changed. Once you have a user, you ran retrieve the appRoleAssignment resources for them and store them in your external data store.
For the list of potential appRole resources that might be assigned to a given user, you can get this by retrieving the list of application resources from the tenant and looking at the appRoles property (/beta/applications?$select=appRoles).
For near-real-time changes, you can use the /beta/users/delta and then periodically poll both user and application collections to fully refresh the larger data set.
Keep in mind that this isn't something I've attempted to POC so there may be issues I'm not considering. It is entirely within the /beta endpoint which means API behavior and data sets could change at any time and without warning. That said, it's a very interesting thought exorcise. I'd be curious to hear where you end up with this.
Just to clarify for anyone who might surface this in a search, Azure AD Graph and Microsoft Graph are two separate APIs and user different permission scopes and syntax. In general, developers should be using Microsoft Graph wherever possible as it will eventually supplant the older Azure AD Graph.
