Identifying and filtering tenants using multi-tenant Azure AD SSO (Open ID Connect)

We have a SaaS web application hosted with a non-Azure provider. Currently users access it via built-in individual user accounts, but we are implementing multi-tenant SSO via Azure AD (Open ID Connect). The aim here is for each organisation (using Azure AD) to subscribe to our web application to allow their users to sign in.

Validating Tokens Issued by AspNet.Security.OpenIdConnect.Server (ASP.NET vNext)

I am using Visual Studio 2015 Enterprise and ASP.NET vNext Beta8 to build an endpoint that both issues and consumes JWT tokens. I Originally approached this by generating the tokens myself, as described here.
Later a helpful article by @Pinpoint revealed that AspNet.Security.OpenIdConnect.Server (a.k.a. OIDC) can be configured to issue and consume the tokens for me.