EntraID + F5 as Oauth client/resource server not sending ID Token to app

Hello,

Here is the basic setup. 

F5 is configured to use EntraID and is set up as the client+resource server. When a user logs into the web app via EntraID they are able to login just fine. However, the web app only receives an access token via the F5. The web app gets invalid signature errors when trying to validate the access token. As per this conversation, ID tokens are to be used for validating users. 

I guess my overall question is, how do we send the ID token to the virtual server as well as the access token? I have OIDC connect enabled in the Oauth client in the access profile. I'm still fairly new to how oauth (and the F5) works so maybe I missed something obvious.