...
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = https://login.partner.microsoftonline.cn/<common or tenant id>;
        options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            ValidateIssuerSigningKey = false,
            ValidateAudience = true,
            ValidateIssuer = true,
            ValidateLifetime = true,
            ValidAudience = "Entra ID Application ID",
            ValidIssuer = https://login.partner.microsoftonline.cn/<common or tenant id>/v2.0,
        };
        options.BackchannelHttpHandler = new HttpClientHandler
        {
            UseProxy = true,
            Proxy = Utility.GetWebProxy(httpConfiguration)
        };
       
       options.Events ??= new JwtBearerEvents();
       var onTokenValidatedHandler = options.Events.OnTokenValidated;
        options.Events.OnTokenValidated = async context =>
        {
            var httpContext = context.HttpContext;
            lock (httpContext)
            {
                httpContext.Items[ServiceConstants.HttpContextTokenKey] =
                (context.SecurityToken is JwtSecurityToken or JsonWebToken ? context.SecurityToken : null);
            }
            await onTokenValidatedHandler(context).ConfigureAwait(false);
        };
    });
 ...