v8.7 on AKS

We are trying to implement Azure Open ID SSO from our app and we have setup everything and can see the authentication working but when the system tries to read some of the claims info to create operator id, it throws an error as below. I've parsed the token and can see the claims in it. These are all default claims (i.e. not customized to add any other claims) and the system can read some of them while not some for operator creation. Any idea why that could be?

"Unable to derive claim {claim_name} from id token for operator establishment"

Reference to the azure doc which lists the default v2 claims and as an example the system is able to read {name} but it cannot read {preferred_username}. Please note, we have defined the openid, profile and email scopes. https://learn.microsoft.com/en-us/azure/active-directory/develop/id-tokens