I have this flow using HTTP trigger with authentication parameter Any user in my tenant:

App registration permissions:

I’m calling this flow with a fetch from a D365 CRM form request using MSAL authentication.
Here are relevant parts of the code:

MSAL configuration:

var msalConfig = {
    auth: {
        clientId: "{clientId}",
        authority: "https://login.microsoftonline.com/{tenantId}",
        redirectUri: "https://localhost"
    }
};

Defining request user account:

const result = await Xrm.WebApi.retrieveRecord("systemuser", userId, "?$select=azureactivedirectoryobjectid,domainname");

account = {
    "homeAccountId": result.azureactivedirectoryobjectid,
    "environment": "login.microsoftonline.com",
    "tenantId": globalContext.organizationSettings.organizationTenant,
    "username": result.domainname,
    "localAccountId": result.azureactivedirectoryobjectid,
    "name": globalContext.userSettings.userName
}

Requesting token:

async function getToken(){
    const request = {
        account: account,
        scopes:
            [
                "https://service.flow.microsoft.com/User",  // Access flows under user impersonation
            ]
    };

    const silentResponse = await msalInstance.acquireTokenSilent(request);
    return silentResponse.accessToken;
}

Calling flow:

function makeFlowRequest() {

    const flowUrl = "https://prod-22.canadacentral.logic.azure.com:443/workflows/cde14e95...";
    const accessToken = await getToken();      
    fetch(flowUrl, {
        method: "POST",
        headers: {
            "Authorization": `Bearer ${accessToken}`,
            "Content-Type": "application/json"
        }
    })
}

The token is generated successfully. I tested making a Graph https://graph.microsoft.com/v1.0/me request (after changing the scope) and it returned the expected info.

I checked the claim token using https://jwt.io/ and all the data looks good:

{
  "aud": "https://service.flow.microsoft.com",
  "iss": "https://sts.windows.net/{tenantId}/",
  "oid": "{EntraId}",
  "tid": "{tenandId}",
   (...)
}

When calling the flow, I keep getting error 403 (Forbidden) back.
What am I missing here?