Are you sure you have looked over the app registration in Azure portal as well as the enterprise apps sections (you can configure both and they have unique variables that might be worth revising. They can be found in the Azure portal App Registrations and Enterprise Apps, respectively. with the correct information, especially concerning the scope, permissions and app roles? Make sure too go to the Api permissions and grant the correct ones to your app, such as "offline_access", which is crucial for some sign-ins.

Microsoft graph API permissions can be used under the API permissions under App Registrations (your app name). I usually just look at those APIs and write my app roles/scopes/api permissions from the ones that are listed there by mixing and matching a few words around.

It does look like the fatal error is derived from misconfiguration in the token configuration, and since you are using openidconnect be sure you have all the small details specific to this protocol. It relies on your configuration of the Token exchange and the correct permissions and scopes. I hope this answer can give some clue in this mysterious affair.