Grafana Azure AD SSO login

Stack is EKS, Route53 record, Istio VirtualService, grafana helm chart, terraform(iac).
I can login to grafana through browser, but can’t do anything else, kick out if I click on something else after some time. Please any suggestion, thank you!

I’ve checked this changed my configuration

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  creationTimestamp: "2022-09-26T19:56:38Z"
  generation: 4
  name: grafana-vs
  namespace: istio-system
  resourceVersion: "23872884"
  uid: 8c97c02b-46a8-4cc7-9411-5bf35bc432b6
spec:
  gateways:
  - bnpl-frontend/api-gateway-gtw
  hosts:
  - grafana.us-west-2.abc.equipifi.int
  http:
  - route:
    - destination:
        host: grafana.istio-system.svc.cluster.local
        port:
          number: 3000

Changed : in values.yaml

service:
  portName: http-service
  port: 3000
  targetPort: 3000
grafana.ini:
  auth.azuread:
    name: Azure AD
    enabled: true
    allow_sign_up: true
    scopes: "openid email profile"
    auth_url: https://login.microsoftonline.com/12312312df65c/oauth2/v2.0/authorize
    token_url: https://login.microsoftonline.com/123123123123123/oauth2/v2.0/token
    allowed_groups: aa4af4d0-47cf-4a79-989d-0df61fa68b18

Browser Network errors:

Request URL: https://grafana-istio.us-west-2.dev.abc.int/api/dashboards/home
Request Method: GET
Status Code: 401 
Remote Address: 10.6.17.188:443
Referrer Policy: strict-origin-when-cross-origin
Request URL: https://grafana-istio.us-west-2.dev.abc.int/api/frontend-metrics
Request Method: POST
Status Code: 401 
Remote Address: 10.6.17.188:443
Referrer Policy: strict-origin-when-cross-origin
Request URL: https://grafana-istio.us-west-2.dev.abc.int/api/search?query=&starred=false&skipRecent=true&skipStarred=true&folderIds=0&layout=folders&prevSort=null
Request Method: GET
Status Code: 401 
Remote Address: 10.6.17.188:443
Referrer Policy: strict-origin-when-cross-origin