I'm finding validate-azure-ad-token policy to be completely unusable. With the validate-jwt policy, I can troubleshoot problems with the policy configuration or the incoming JWT by using the "Test" tab in API Management, performing a "Trace", and then look at the response message for a detailed error message in the "On Error" section. However, with validate-azure-ad-token policy, no useful error message is returned in the Trace response. Instead, the only error message is, "Azure AD JWT Validation Failed: ValidationFailed." As far as I can tell, I have tried to configure the validate-azure-ad-token policy to have the same configuration as the validate-jwt policy I was using successfully, yet the validate-azure-ad-token policy fails.
How is one supposed to troubleshoot issues with the validate-azure-ad-token policy?