After you add scope "accounts", you must set "accounts" scope to all API entry.
You must modify "Caller type" to "Application" the following API entries:
/account-access-consents
/account-access-consents/{ConsentId}
/account-access-consents/{ConsentId}
The remain API entries still "Application & Application User".