Hi Kimmo. Thank you.

Did you provide the managed identity with "Orders.Read" permission?

m365 aad approleassignment add — displayName “client-function-app” — resource “server-app-reg-name” — scope “Orders.Read”