Anyone successfully call the MS Graph API from sp_invoke_external_rest_endpoint using a managed identity?

Using access tokens seems unreliable because sometimes the tokens are longer than the 4000 character limit for headers and secrets. I've been trying to get a user managed identity to work but I keep getting "invalid audience" errors.