The Microsoft-side app owner provides a trust description of the incoming token based on issuer, subject, and audience - https://docs.microsoft.com/en-us/azure/active-directory/deve...