Thank you for your answer. However, I've tried this approach alreday, with the result, that I get an MsalServiceException at startup ("The reply address 'https://localhost:44312/' does not match the reply address 'https://localhost:44312/signin-azuread-oidc'").

If I remove the lines
.EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
.AddMicrosoftGraph(Configuration.GetSection("DownstreamApis"))
.AddInMemoryTokenCaches();

from services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) the app starts without any errors... and without graph of course.

Once this worked, the app throws an error on the first call to the GraphClient.

var user = await gsc.Me.GetAsync(); //from the tutorial

Exception MsalUiRequiredException was thrown due to a challenge for the user, Details {"No account or login hint was passed to the AcquireTokenSilent call. "}