In short: initial query with empty deltaLink works fine, subsequent call with deltaLink set to aad.deltaLink from initial response fails with code 404 (not found).
Absolutely the same behavior I see in MS sample and on https://graphexplorer.cloudapp.net/. It works for demo company "GraphDir1.OnMicrosoft.com", but not for 2 domains which I have tried on.
Moreover, MS sample for differential query ( http://code.msdn.microsoft.com/Sample-App-for-Windows-97eaec90 ) does not work with my domain and service principal until I rewrite authentication to use AAL.
Service principal is in Domain Readers role, also tried adding it to Company Administrators, no change.
Either I'm missing something obvious or devs have forgotten to describe something in documentation or update sample appropriately.