<authentication mode="None" />
    <membership>
      <providers>
        <clear/>
      </providers>
    </membership>
    <roleManager enabled="false">
      <providers>
        <clear/>
      </providers>
    </roleManager>

<episerver.framework>
    <securityEntity>
      <providers>
        <add name="SynchronizingProvider" type ="EPiServer.Security.SynchronizingRolesSecurityEntityProvider, EPiServer"/>
      </providers>
    </securityEntity>
    <virtualRoles addClaims="true">
       //existing virtual roles
    </virtualRoles>

Install-Package Microsoft.Owin.Security.Cookies
Install-Package Microsoft.Owin.Security.OpenIdConnect
Install-Package Microsoft.Owin.Host.SystemWeb
Update-Package Microsoft.IdentityModel.Protocol.Extensions -Safe

using System;
using System.Configuration;
using System.Globalization;
using System.Threading.Tasks;
using System.Web;

using Owin;
using Microsoft.Owin;
using Microsoft.Owin.Extensions;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.Notifications;
using Microsoft.Owin.Security.OpenIdConnect;

using EPiServer.Security;
using EPiServer.ServiceLocation;

public class Startup
{
  // <add key="ida:AADInstance" value="https://login.microsoftonline.com/{0}" />
  private static readonly string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
 
  // <add key="ida:ClientId" value="Client ID from Azure AD application" />
  private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];

  //<add key="ida:PostLogoutRedirectUri" value="https://the logout post uri/" />
  private static readonly string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

  private static string commonAuthority = String.Format(CultureInfo.InvariantCulture, aadInstance, "common/");

  const string LogoutPath = "logout path"; 

  public void Configuration(IAppBuilder app)
  {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            ClientId = clientId,
            Authority = commonAuthority,
            PostLogoutRedirectUri = postLogoutRedirectUri,
            TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
             {
                 ValidateIssuer = false,
                 RoleClaimType = ClaimTypes.Role
             },
             Notifications = new OpenIdConnectAuthenticationNotifications
             {
                 AuthenticationFailed = context =>
                 {
                     context.HandleResponse();
                     context.Response.Write(context.Exception.Message);
                     return Task.FromResult(0);
                 },
                 RedirectToIdentityProvider = context =>
                 {
                     // Here you can change the return uri based on multisite
                     HandleMultiSitereturnUrl(context);
                     
                     // To avoid a redirect loop to the federation server send 403 
                     // when user is authenticated but does not have access
                     if (context.OwinContext.Response.StatusCode == 401 && 
                         context.OwinContext.Authentication.User.Identity.IsAuthenticated)
                     {
                         context.OwinContext.Response.StatusCode = 403;
                         context.HandleResponse();
                      }
                      return Task.FromResult(0);
                    },
                    SecurityTokenValidated = (ctx) =>
                    {
                       var redirectUri = new Uri(ctx.AuthenticationTicket.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
                       if (redirectUri.IsAbsoluteUri)
                       {
                            ctx.AuthenticationTicket.Properties.RedirectUri = redirectUri.PathAndQuery;
                        }
                           //Sync user and the roles to EPiServer in the background
                        ServiceLocator.Current.GetInstance<ISynchronizingUserService>().
                        SynchronizeAsync(ctx.AuthenticationTicket.Identity);
                        return Task.FromResult(0);
                     }
                    }
                   });
                app.UseStageMarker(PipelineStage.Authenticate);
                app.Map(LogoutPath, map =>
               {
                  map.Run(ctx =>
                  {
                    ctx.Authentication.SignOut();
                    return Task.FromResult(0);
                  });
               });
           }

        
         private void HandleMultiSitereturnUrl(
                 RedirectToIdentityProviderNotification<Microsoft.IdentityModel.Protocols.OpenIdConnectMessage, 
                                         OpenIdConnectAuthenticationOptions> context)
        {
           // here you change the context.ProtocolMessage.RedirectUri to corresponding siteurl
           // this is a sample of how to change redirecturi in the multi-tenant environment
            if (context.ProtocolMessage.RedirectUri == null)
            {
                var currentUrl = EPiServer.Web.SiteDefinition.Current.SiteUrl;
                context.ProtocolMessage.RedirectUri = new UriBuilder(
                   currentUrl.Scheme, 
                   currentUrl.Host, 
                   currentUrl.Port, 
                   HttpContext.Current.Request.Url.AbsolutePath).ToString();
            }
        }
    }

 "appRoles": [
    {
      "allowedMemberTypes": [
        "User"
      ],
      "description": "Editor can edit the site.",
      "displayName": "WebEditors",
      "id": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
      "isEnabled": true,
      "value": "WebEditors"
    },
    {
      "allowedMemberTypes": [
        "User"
      ],
      "description": "Admins can manage roles and perform all task actions.",
      "displayName": "WebAdmins",
      "id": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX",
      "isEnabled": true,
      "value": "WebAdmins"
    },
     {
      "allowedMemberTypes": [
        "User"
      ],
      "description": "Admin the site.",
      "displayName": "Administrators",
      "id": "XXXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX",
      "isEnabled": true,
      "value": "Administrators"
    }
  ],

After declaring the approles, you need to upload the manifest to the Azure Active Directory application. Refer to Roles based access control for more information.

Assigning users and groups to application roles

After a global administrator of the customer’s organization installs your application, either they or a user accounts administrator in their organization can assign users and groups to your application.

1. Navigate to the users tab under the application to which you would like to assign users and groups.
2. Select a user.
3. Click the Assign action on the bottom bar. Here you can assign the desired role to the user.

Known problems

• If you are using System.IdentityModel.Tokens.Jwt version 4.0.0 or lower, it is required to set RoleClaimType = "roles" in the TokenValidationParameters.
• If the application throws an antiforgery token exception like “AntiForgeryToken: A Claim of Type NameIdentifier or IdentityProvider Was Not Present on Provided ClaimsIdentity,” set AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier.