We are using ping federate for Single sing on(only authentication).In ping federate for id token signature validation , we are reading public key from ping certificate and validating id token.
Right now we are migrating ping federate to azure AD for SSO authentication.

We are planning to use open id+oauth for token generation .once we receive the token from Azure ad how do we validate that token signature ?
What is the best way to validate Azure AD Id token signature validation ?
Can we use keys end point below ?
Form the keys end point we get kid and from Azure ad token we get kid ,using kid we get the respective public key from below url.

https://login.microsoftonline.com/%7Btenant_id%7D/discovery/keys?appid=%7Bclient_id%7D

Open question from onboarding team:
our IAM TEAM asking us to provide certificate ,in ping federate they have provided certificate now in Azure ad do we need to use certificate for token signature validation?if yes who will provide the certificate as token is generating by Azure ad ,Azure ad has to provide certificate as well .
Instead of using certificate can we use above keys end point to retrieve public key ?

Note : in ping federate(current flow ) we are using only certificate for public key .cert has public key ,reading public key from cert and validating id token signature .

Kindly please help on this .
We are using Azure ad just for Authentication.

What is the standard way to validate Azure ad id token signature ?
Kindly help here