API Management OAuth 2.0 configuration issue

I am following this article to configure the API Management with OAuth 2.0 , However I am getting below error during the authentication in APIM Developer Portal - API Trigger.

{"code":"Unauthorized","message":{"error":"invalid_client","error_description":"AADSTS650052: The app is trying to access a service 'XXXXXXXX-1f80-4ded-a96a-XXXXXX'(oauth-backend-api) that your organization '65e4e06f-f263-4c1f-becb-90deb8c2d9ff' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal. Trace ID: 8e6c4fac-b3fd-460c-976b-91ccca094c00 Correlation ID: a65c5507-da87-47ce-841a-de29985af0dc Timestamp: 2024-08-10 23:11:17Z","error_uri":"https://login.microsoftonline.com/error?code=650052","state":"e689f2d6-be48-1230-b0b7-2d790cb5589f"

Policy configuration as below

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
            <openid-config url="https://login.microsoftonline.com/XXXXXXX/v2.0/.well-known/openid-configuration" />
            <required-claims>
                <claim name="aud">
                    <value>XXXXXXXX-1f80-4ded-a96a-XXXXXX</value>
                </claim>
            </required-claims>
        </validate-jwt>

Resolve - By changing the multi tenant to single tenant in the SPN

New error : AADSTS700016: Application with identifier 'XXXX-2ab2-XX-XX-XXX' was not found in the directory 'XXXXXXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

Below are the current API Permissions

Backend App - Expose an API configuration.

Url - https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4adcXXXXXXXXX&redirect_uri=https%3A%2F%2Fcentenedevpoc.developer.azure-api.net%2Fsignin-oauth%2Fcode%2Fcallback%2Foauth-authorizationcodeflow&response_type=code&state=fac40977-6fe9-3ed8-81bb-f25abda7833a&scope=api%3A%2F%2F4514b786-0fab-424c-af62-90d97d4cfbe5%2F.default

{"code":"Unauthorized","message":{"error":"invalid_client","error_description":"AADSTS650052: The app is trying to access a service 'XXXXXXXX-1f80-4ded-a96a-XXXXXX'(oauth-backend-api) that your organization '65e4e06f-f263-4c1f-becb-90deb8c2d9ff' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal. Trace ID:8e6c4fac-b3fd-460c-976b-91ccca094c00 Correlation ID:a65c5507-da87-47ce-841a-de29985af0dc Timestamp: 2024-08-10 23:11:17Z","error_uri":"https://login.microsoftonline.com/error?code=650052","state":"e689f2d6-be48-1230-b0b7-2d790cb5589f"

In order to get rid of this error, you need to add the client id of oauth-client-app in oauth-backend-app as shown below and keep both the apps in multi tenant only.

I am using given policy in apim.

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
            <openid-config url="https://login.microsoftonline.com/932********f6d/v2.0/.well-known/openid-configuration" />
            <issuers>
                <issuer>https://sts.windows.net/932********f6d/</issuer>
            </issuers>
            <required-claims>
                <claim name="aud">
                    <value>3a31*********c0b</value>
                </claim>
            </required-claims>
        </validate-jwt>
    </inbound>
</policies>

Then published the developer portal and got below screen to get the bearer token and clicked Accept.

Then got 200 OK response.