I added my Moodle instance as an Azure AD Enterprise app.
The login works well, but fails in a very specific way (which tends to be quite popular amongst users).
When people click on the login button, they get redirected to the Microsoft login page. Most of the time, through SSO, they're already logged in... so they just click on their account instead of waiting for the auto redirect to do its job. This is when everything crashes.
If people just wait it out and let the autologging work, they'll access Moodle successfully.
Here's the Login page I'm talking about:
If people click their account on the Microsoft login page, they'll get Incorrect SessKey error.
The Azure AD Enterprise App connection logs shows the following error when an error happens:
The application tried to perform a silent sign in and the user could not be silently signed in. The application needs to start an interactive flow giving users an option to sign in. Contact app owner.