Retrieve “on-behalf” Token from Azure OIDC IDP