var requestInfo = graphClient.Users["{user_id}"]
                             .Messages["{message_id}"]
                             .Attachments["{attachment_id}"]
                             .ToGetRequestInformation();
requestInfo.UrlTemplate = requestInfo.UrlTemplate
                           .Insert(requestInfo.UrlTemplate.LastIndexOf('{'), "/$value");
var attachmentStream = await graphClient.RequestAdapter.SendPrimitiveAsync<Stream>(requestInfo);

AttachmentsRequestBuilder GetAttachmentsList(string id) =>
    graphClient.Users[userId].Messages[id].Attachments;
var attachmentList = await GetAttachmentsList(messageId)
    .GetAsync(cancellationToken: cancellationToken);
if (attachmentList?.Value != null)
{
    foreach (var attachmentItem in attachmentList.Value)
    {
        var attachmentRequest = GetAttachmentsList(messageId)[attachmentItem.Id];
        var getRequestInfo = attachmentRequest.ToGetRequestInformation();
        var attachmentUri = getRequestInfo.URI + "/$value";
        using var client = httpClientFactory.CreateClient();
        client.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", await GetToken());
        var response = await client.GetAsync(attachmentUri, cancellationToken);
        var file = await response.Content.ReadAsByteArrayAsync(cancellationToken);
    }
}

private async Task<string> GetToken()
{
    using var client = httpClientFactory.CreateClient();
    var @params = new Dictionary<string, string>()
    {
        { "client_id", clientId },
        { "client_secret", clientSecret },
        { "scope", "https://graph.microsoft.com/.default" },
        { "grant_type", "client_credentials" },
    };
    var response = await
        client.PostAsync($"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token",
            new FormUrlEncodedContent(@params));
    response.EnsureSuccessStatusCode();
    using var sr = new StreamReader(await response.Content.ReadAsStreamAsync());
    var body = await sr.ReadToEndAsync();
    var jobject = JObject.Parse(body);
    return jobject["access_token"]!.ToString();
}