Entra SSO via OpenID throws 401

[mowe]

I installed PVE 9.1.8 yesterday on a host and am now trying to set up Entra SSO with Microsoft 365.
The app is authorized, has enough permissions, sign-in succeeds, and even the auth data is transmitted via the URL.
For some reason I do still get the following error:

OpenID login failed, please try again
authentication failure (401)

Does anyone have an idea what could cause this issue?

 

[a.bied-charreton]

Hey, can you please share the output of journalctl -xeu pvedaemon when attempting an OpenID login?