Facing challenges on FHIR service Cross Tenant access

We have two tenant

1. abc.onmicrosoft.com [Microsoft External Entra ID - App Registration [React App and API + User Flow for login + Users]]

• Authority: PII
• React APP: Client ID: PII
• API APP: Client ID:PII, Secret Key: V-N8Q~jITWotH~uC*******

1. xyz.onmicrosoft.com [Microsoft Workforce Entra ID, FHIR Service] [No - App Registration]

• Authority: PII
  • FHIR Service
    • URI: https://healthnew.fhir.azurehealthcareapis.com Now, FHIR Service > Authentication

Top Authority & Audience field

  - Authority: [https://login.microsoftonline.com/PII()

  ```yaml
- Audience: [https://healthnew-fhirservice.fhir.azurehealthcareapis.com]()

- Authority: PII
- Client ID: PIIa
- Audience: PII

So, Now we need to generate the token for FHIR API on behalf token
inside the assertion token we need pass the same Microsoft Entra ID token to generate the access token for FHIR service 

POST - [https://login.microsoftonline.com/]()PII
Body: x-www-form-urlencoded
grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
client_id:
client_secret:
scope:
requested_token_use: on_behalf_of
assertion: [We are passing JWT token which generate using abc.onmicrosoft.com - Signup signin Userflow[React APP + API]]

Which value need to pass: client_id, client_secret and scope 

here us my JWT token decode value
{
"aud": "PII",
"iss": "https://PII.ciamlogin.com/PII/v2.0",
"iat": 1766118411,
"nbf": 1766118411,
"exp": 1766123211,
"aio": "AVQAq/PII=",
"azp": "PII",
"azpacr": "0",
"name": "ABC Patel",
"oid": "PII",
"preferred_username": "******@PII.com",
"rh": "PII.",
"scp": "api_read",
"sid": "PII",
"sub": "PII",
"tid": "PII",
"uti": "PII",
"ver": "2.0",
"xms_ftd": "PII"
}

We need to pass the user context in FHIR aPI access - means any write operation take so ECM - will take reference who updated the data

We have tried but getting Bad Request
Response
{
"error": "invalid_grant",
"error_description": "AADSTS50020: User account '{EUII Hidden}' from identity provider 'https://sts.windows.net/PII/' does not exist in tenant 'Default Directory' and cannot access the application 'PII'() in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account. Trace ID: 0e30f4fa-aad8-4fd9-a5fc-6437357d0100 Correlation ID: 5292e84d-d268-4bfc-a8d6-4030a68a9852 Timestamp: 2025-12-19 09:12:52Z",
"error_codes": [
50020
],
"timestamp": "2025-12-19 09:12:52Z",
"trace_id": "0e30f4fa-aad8-4fd9-a5fc-6437357d0100",
"correlation_id": "5292e84d-d268-4bfc-a8d6-4030a68a9852",
"error_uri": "https://login.microsoftonline.com/error?code=50020"
}