Multi-Tenant App with dynamic configuration from Azure App Configuration

Hi all,

We are developing MS Teams Tab app that will be distributed to multiple tenants.
The goal is to let customers create their configuration on a tenant level.
For that we found a Azure App Configuration service.

To retrieve settings from Azure App Configuration from the Tab, we thought of these steps:

1. Customer Tenant admin creates Azure App Configuration in their own Domain,
2. Customer Tenant admin adds settings in a specific key,
3. Customer Tenant admin assign the App Configuration Data Reader role to all users in tenant.
4. Our Tenant admin add permission in Azure App Registration to access App Configuration on behalf of user.
5. From Tab app, authenticate user with AAD,
6. From Tab app, request resource from App Configuration via REST API.

Since App Configuration is behind subscription, we want to clarify if the steps are achievable at all.
The questions are:

• In terms of App permissions, what are the permissions we need to include in App Registration, to access Azure App Configuration (in customers tenant) on behalf of user?
• Can Azure ID token from "login.microsoftonline.com" be used to request Azure App Configuration resource via HTTP REST API?

Thanks in advance!