Azure中类似AWS会话标签的自定义声明验证等效方案问询

我需要在Azure中找到与AWS会话标签功能对等的自定义声明验证方案。AWS的会话标签支持通过策略验证会话标签条件，示例策略如下：

{
    "Sid": "AllowPassSessionTagsAndTransitive",
    "Effect": "Allow",
    "Action": "sts:TagSession",
    "Principal": {"AWS": "arn:aws:iam::123456789012:user/test-session-tags"},
    "Condition": {
    "StringLike": {
        "aws:RequestTag/Project": "*",
        "aws:RequestTag/CostCenter": "*"
    },
    "StringEquals": {
        "aws:RequestTag/Department": [
            "Engineering",
            "Marketing"
        ]
    },
    "ForAllValues:StringEquals": {
        "sts:TransitiveTagKeys": [
            "Project",
            "Department"
         ]
      }
   }
}

背景信息：我持有一个包含自定义声明的OIDC令牌，示例如下：

{
  "alg": "HS256",
  "kid": "12345",
  "typ": "JWT"
}.
{
  "aud": "AUDIENCE_NAME",
  "iss": "SOME_ISSUER",
  ...
  "customClaim1": "foo",
  "customClaim2": "bar",
}

我已经查阅了Azure的工作负载身份联合和条件访问文档，但未找到能在颁发Azure访问令牌前验证customClaim1 == "foo"的功能。我希望在Azure中配置类似AWS的信任策略，仅当自定义声明/会话标签符合特定条件时，才授予OIDC令牌访问权限。Google也提供了类似的功能。

内容的提问来源于stack exchange，提问作者ADavies1234