EntraID + F5 as Oauth client/resource server not sending ID Token to app

I am bit confused
When you talk about web app you are reffering to the actual web app server or to an APM policy
Cause if you want to consume oauth tokens on web app (pool member) you need to configure it as resource server too.
Otherwise it makes totally sense no to be able to validate the token

as for ./default scope it seems to be a special scope which should not be used in cases like this.
and yes it somehow don't need the jwt key to be validated