Configuring OIDC SSO for organization with multi geo database environments

Dear Community,

Having some issues configuring OIDC Single Sign On. We are using Microsoft Entra (AzureAD) as our identity provider and authenticating using ID token. We feel this is probably a fairly common config amongst the community. Would anybody be able to confirm the redirect URL for such a config? We are using:

Our mapped attributes are:

NameID == userPrincipalName

Email == mail

firstname == givenName

lastname == surname

The config seems to be correct on the Azure side, and the app logs a successfull authentication attempt. However, when redirected back to the URL above, BB returns a generic error. See image:

We've also tried config using PSK/application secret code to authenticate, but that did not seem to make a difference. We feel that there may be a different/additional redirect URL required for organizations in a multi geo/ multi database situation, as there's sometimes an intermediate page that requires the user to select the database environment, based on what their provisioned to. Any guidance would be greatly appreciated.