This has been a great help to us, thanks Steve.
One question (for everyone). With azure we've used response_type=token with response_mode=fragment to get an id_token however we get .../?oauth2callback=azure#access_token=eyJ0eXAiO..... as the response with # being used as a separator.
Is there an easy way to get the access token as only oauth2callback=azure is listed in the UniApplication.parameters?
EDIT: Ah I think I've found the answer, for security reasons fragments, anything after the #, aren't sent to the server from the browser so we have to stick with the code flow method