Event Grid AzureFunction destination returns intermittent Unauthorized on Flex Consumption plan, zero App Insights traces, works fine on Consumption plan

Environment

• Azure Function App plan: Flex Consumption
• Trigger type: EventGridTrigger
• Event Grid destination type: AzureFunction (resource-based, resourceId pointing to function, no embedded ?code= key)
• Event Grid topic type: Custom Topic
• Event delivery schema: CloudEventSchemaV1_0
• AzureWebJobsStorage: full connection string (not managed identity)
• alwaysReadyInstances: 0 (default)

Problem

After migrating a Function App from Consumption plan to Flex Consumption plan, Event Grid deliveries to an EventGridTrigger function begin failing intermittently with outcome=Unauthorized. The same setup worked correctly on the Consumption plan with no changes to the Event Grid subscription or function code.

Example from Event Grid delivery failure log:

outcome=Unauthorized, deliveryCount=6, probationCount=4,
state=FilteredFailingDelivery, deliveryResponse=Unauthorized,
errorCode=Unauthorized, StatusCode=Unauthorized(401)
armId=/subscriptions/.../providers/Microsoft.Web/sites/<app-name>/functions/<function-name>

The failures are intermittent some delivery attempts succeed and some fail with Unauthorized for the same event subscription and function, with no pattern tied to event type or subject.

What I already tried:

1. Deleted and recreated the Event Grid subscription
2. Checked Application Insights for any trace of the failed deliveries. Zero traces exist for the failing invocations. Successful deliveries show traces normally. This means the requests are being rejected before reaching the Functions host pipeline entirely