How to authenticate my application (running as an Azure App Service) against another Azure App service using Managed Identites?

Question

We have two applications that run in two different Azure App Services:

1. A ASP.NET 4.6.2 application that Hosts a website and utilizes a web job that communicates with the other App Service over gRPC (using the older Grpc.Core package because App Services are still using Windows 10)
2. An ASP.NET Core 8 Grpc API that is only accessed by the other App Service.

Because the second App Service is only accessed from the other App Service within our organization and we don't want to use VNETs to control IP-base access, we would like to use Azure Managed Identities.

Not I've followed several Microsoft tutorials on how to configure Managed Identities for the applications and this is what I thought was what had to be done:

1. Enable "System Assigned" Managed Identity in App Service A
2. Assign this Managed Identity / principal any role in App Service B
3. Modify the Code running on App Service A to include authentication / authorization when sending requests to App Service B
   1. Create a new instance of "DefaultAzureCredential" from the "Azure.Identity" NuGet package
   2. Call "GetTokenAsync" on that instance
   3. Including the "Authorization" header in the MetaData of the Grpc request to App Service B and assigning it the value $"Bearer {tokenResponse.Token}" (tokenResponse being the response of "GetTokenAsync")
4. Possibly add the Microsoft Authentication Provider to App Service B?

Now when trying this out, I have not been able to get this running and now I have a couple of questions about what has to be done:

1. Can I just assign any role to the Managed Identity of App Service A in App Service B? App Service B does not need any permission, just a valid token that says that the request comes from a Managed Identity.
2. When calling "DefaultAzureCredential.GetTokenAsync" what scopes do I have to provide with "TokenRequestContext"?
   1. For testing purposes I have tried to specify different GUIDs and URLs. For example the application ID of App Service A which - when executed from Visual Studio - returns an error AADSTS: "AppId: 'x' can not use Managed Service Identity (MSI) as audience..."
      (Since when executing from Visual Studio "DefaultAzureCredential" should use my signed in account, I also made sure that my account has been assigned a role to)
3. When calling App Service B using Grpc, does it automatically detect the Authorization Header? If not, is this why I have to add the Microsoft Authentication Provider to App Service B? And if so, how would I configure it?
   1. I have already tried to configure the Microsoft Authentication Provider but I don't know how to configure it. For example can I use "Allow requests from any application" in combination with "Allow requests from specific identities"? The latter makes a new field appear "Allowed identities" in which I can put any string. What would I need to put in there? The object ID of the Managed Identity?

Any help would be greatly appreciated.