my API is accessed by external clients and some clients uses Microsoft Account token and some clients uses Entra token. in case of Entra token, i have to verify client application id. How can i achieve this in APIM. do i have to use validate-jwt and read issuer and the have choose block to add validate-azure-ad-token policy? or there is any other way to achieve it.