Has anyone here had experience of authenticating against Azure Active Directory? Tricks, tips, pitfalls?

Yes, although we only use the access token passed through from our front-end (angular), so the actual authentication / renewal is done there. We only do on-behalf-of auth in our application / api using Azure Active Directory.

Try to avoid SAML2 stick with openId Connect

Thank you both. I'll bear your comments in mind.