CORS Error When Calling https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token in React.js Outlook Add-In

Question

I'm developing a React.js-based Outlook add-in and facing a CORS issue while calling the API https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token.

Payload as follows:
{ "client_id": clientId, "client_secret": clientSecret, "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "requested_token_use": "on_behalf_of", "scope": scopes, "assertion": Token A }

I can successfully call the API using Postman with the same request parameters, and it returns the expected response.

When making the same API call from the add-in (running locally), I am getting CORS error in the browser console:

What we tried:

1. Verified the request headers and body match the working Postman configuration.
2. Checked Azure AD app registration for proper redirect URIs and CORS settings, but the issue persists.

Queries:

1. Why does the https://login.microsoftonline.com endpoint block CORS when accessed from a browser environment in the Outlook add-in?
2. Is there a recommended way to make such API calls in an Outlook add-in without running into CORS issues?
3. Should this flow use a proxy server or some other mechanism to bypass the CORS restriction?