Use Entra ID as Identity Provider for Client Credentials flow

I have registered an App on my Entra ID (just created as an empty placeholder, NOT connected with an azure resource like an app service; only audience: Microsoft.Graph) and I successfully retrieved a token using postman.
I have a spring boot application, running locally on my pc, that expose an API; as a test, I'm trying to "protect" programmatically this API using the jwt token from Entra:

My auth config

My .properties

I'm quite sure that the spring boot code is corretct (I've tested with a token from another Identity Provider and everything works as espected).
But when i try to use a token from Entra (valid token; jwt.io converted succesfully) I get an error like "Invalid Signature". Checking the log, I can see that the spring boot app is actually retrieving a list of certificates, so I'm assuming that the issuer-uri is correct (in any case, I take it from the converted token from jwt.io).
I do not understand the problem, any suggestion on what I'm missing? (is the audience Graph a problem?) Thanks a lot

ANOTHER TEST
I also try to validate the token programmatically (just to see if the token was malformed, invalid etc.):

For the key I'm using the modulus, exponent and encryption (RSA) retrieve from jwt.io, but still the code gave me an error of invalid token (trying the same thing with the token from the other Identity provider works fine).

Note that: The access token with aud as Microsoft Graph is not meant to be validated.

• As Microsoft Graph API is not meant for your app.
• It uses a different approach for signing, so you can't validate Graph API tokens with the same methods.
• Hence you can make use of Microsoft Graph API access token directly without validating it to call the API.

When I tried to validate the Microsoft Graph API token, I got the same error:

I generated access token with scope as https://graph.microsoft.com/.default

Hence pass the token directly without validating it and call the Microsoft Graph API.

If you want to validate the API, then add scope:

And add API permissions like below:

Generated the access token by using scope as api://ClientID/.default:

Signature verified successfully

Reference:

spring security - Verify Signature with Azure AD - Stack Overflow by junnas