Episerver: Authentication with multiple Azure AD Instances

private OpenIdConnectAuthenticationNotifications GetStandardAuthNotification(string returnUrl)
{
    return new OpenIdConnectAuthenticationNotifications
    {
        AuthenticationFailed = context =>
        {
            context.HandleResponse();
            context.Response.Write(context.Exception.Message);
            return Task.FromResult(0);
        },
        RedirectToIdentityProvider = context =>
        {
            // Here you can change the return uri based on multisite
            HandleMultiSiteReturnUrl(context, returnUrl);

            // To avoid a redirect loop to the federation server send 403 
            // when user is authenticated but does not have access
            if (context.OwinContext.Response.StatusCode == 401 &&
                context.OwinContext.Authentication.User.Identity.IsAuthenticated)
            {
                context.OwinContext.Response.StatusCode = 403;
                context.HandleResponse();
            }

            return Task.FromResult(0);
        },
        SecurityTokenValidated = async (ctx) =>
        {
            var redirectUri = new Uri(ctx.AuthenticationTicket.Properties.RedirectUri,
                UriKind.RelativeOrAbsolute);
            if (redirectUri.IsAbsoluteUri)
            {
                ctx.AuthenticationTicket.Properties.RedirectUri = redirectUri.PathAndQuery;
            }
                                                    
            // Interrogate claims to see if they are have the CMSMarketingEditors Azure AD application role
            var Tenant_1_ClaimMatched = ctx.AuthenticationTicket
                                           .Identity.Claims.Where(x => string.Equals("CMSMarketingEditors", x.Value, StringComparison.CurrentCultureIgnoreCase))
                                           .FirstOrDefault();

            if (Tenant_1_ClaimMatched != null)
            {
               ctx.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, "Tenant-1-Editor", ClaimValueTypes.String, AzureTenant_1_SsoId));                   
            }

            // Interrogate claims to see if they are an group editor based on Azure AD Groups. The AD groups use a known pattern
           var azureAD_GroupRegex = new Regex(AzureAD_GroupPattern);
           var claimMatches = ctx.AuthenticationTicket.Identity.Claims.Where(x => azureAD_GroupRegex .IsMatch(x.Value));

           if (claimMatches.Any())
           {
              //Adding a claim to add the user to the special Admin group for the Azure AD 2 tenant users
              ctx.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, "Tenant-2-Users", ClaimValueTypes.String, AzureTenant_2_SsoId));

              foreach (var groupClaim in claimMatches)
              {
                   var adGroupNumber = new string(groupClaim.Value.TakeWhile(Char.IsDigit).ToArray());
                   var episerverGroup = string.Format(adGroupFormat, adGroupNumber.ToString());
                   ctx.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, episerverGroup, ClaimValueTypes.String, AzureTenant_2_SsoId));
               }
            } 

            // Storing role as SSO in claims dictionary. Useful when logging out user.
            ctx.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, "SSO"));
            ctx.AuthenticationTicket.Properties.ExpiresUtc = DateTime.UtcNow.AddHours(48);
            ctx.AuthenticationTicket.Properties.IsPersistent = true;
            //await ServiceLocator.Current.GetInstance<AzureGraphService>().CreateRoleClaimsAsync(ctx.AuthenticationTicket.Identity);

            //Sync user and the roles to EPiServer in the background
            await ServiceLocator.Current.GetInstance<ISynchronizingUserService>()
                 .SynchronizeAsync(ctx.AuthenticationTicket.Identity);

        }
    };
}